Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...2e.exe

windows7-x64

10

JaffaCakes...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_04eaa90b97d1e93f11699edd42617c2e

  • Size

    264KB

  • MD5

    04eaa90b97d1e93f11699edd42617c2e

  • SHA1

    20ff0c8ab078f85896421a58d6db76ad91010ad2

  • SHA256

    ee775cc67e915485c63483798a28b473b6d5ce5e566f8fdc1a7b494016beedb9

  • SHA512

    0bd597b9ae00c791dea3d9cb3837d7e0051089aa646d902917223f8d1588e0ea6b9ef4c134b3c1980f53de36cd276343f630c21a4a582018e3269467032bac93

  • SSDEEP

    6144:VkkozNZIKgiajJzh2pAxpjpJNGYgkbpqrtdFw1+Ur:ykYNKKgiajj2uxJPkytqad

Score
10/10
upxmem0rexcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.02.0

Botnet

mem0rex

C2

mem0rex.no-ip.info:3174

Mutex

JO1P4LO24R12P4

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    csrss.exe

  • install_dir

    install

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Text

  • message_box_title

    Test

  • password

    monkeyballs

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_04eaa90b97d1e93f11699edd42617c2e
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections