Overview

overview

10

Static

static

3

JaffaCakes...e5.exe

windows7-x64

10

JaffaCakes...e5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_1214afafcee8892ff70e343735f4fee5

  • Size

    1.4MB

  • Sample

    250122-3zmacssqhk

  • MD5

    1214afafcee8892ff70e343735f4fee5

  • SHA1

    b7442537012366b950cb57e6785e3c1b44b29ff9

  • SHA256

    ee848bf8c10c176bdf8d4dbe9d8920593d9885cd41c94240d402f755f7b34249

  • SHA512

    0e49c4d90526a94177a4d36f7b428550858e6af3c5a4d7a0e8429c6b9ebf5ce6c3c8aa792d4a6553a704455341abffb5c77258788109ac7d24743a4d4fe4caf5

  • SSDEEP

    24576:hyfHSRuEnbk44eYRko9WEefpHDDO0YP77sVz3whMXPiVFjEWlP9:1uOb34zk4WEeflCF7sVri6Pi7l1

Score
10/10
cybergatesysdiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

sys

C2

modym.no-ip.org:8246

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    DXvi

  • install_file

    system..exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    application software can run on a 64-bit operating system

  • message_box_title

    Java!

  • password

    123123

  • regkey_hkcu

    sys

Targets

    • Target

      JaffaCakes118_1214afafcee8892ff70e343735f4fee5

    • Size

      1.4MB

    • MD5

      1214afafcee8892ff70e343735f4fee5

    • SHA1

      b7442537012366b950cb57e6785e3c1b44b29ff9

    • SHA256

      ee848bf8c10c176bdf8d4dbe9d8920593d9885cd41c94240d402f755f7b34249

    • SHA512

      0e49c4d90526a94177a4d36f7b428550858e6af3c5a4d7a0e8429c6b9ebf5ce6c3c8aa792d4a6553a704455341abffb5c77258788109ac7d24743a4d4fe4caf5

    • SSDEEP

      24576:hyfHSRuEnbk44eYRko9WEefpHDDO0YP77sVz3whMXPiVFjEWlP9:1uOb34zk4WEeflCF7sVri6Pi7l1

    Score
    10/10
    cybergatesysdiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks