Overview

overview

10

Static

static

3

JaffaCakes...f2.exe

windows7-x64

10

JaffaCakes...f2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_170ce0e070165d3e1e26e5dd4f6c75f2

  • Size

    734KB

  • Sample

    250123-pa2f4a1lar

  • MD5

    170ce0e070165d3e1e26e5dd4f6c75f2

  • SHA1

    c9c6facf267c095e39ef326bb80807af1e1245cd

  • SHA256

    9a7cd4edc556f074d7454b4946a72df8381eb86ab2d736971bcd1fbe782636a7

  • SHA512

    f09314d7c338e45579d9ced7c1704f075eb0724f6c47e6978960bfad7e8a9fbe674b05671f8f539e820ed6762d6689ab2cf48c06d9924523730ec1b88c1b8461

  • SSDEEP

    12288:yUWA3AheuswqKETUfnlnoTWFM34Ps+Nn1UXcpYlI8VDRcaO/XdPWmlj:yUWqisBKPdoTWFMoPs+NucpYK8VlDO/D

Score
10/10
cybergatediscoverypersistencestealertrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_170ce0e070165d3e1e26e5dd4f6c75f2

    • Size

      734KB

    • MD5

      170ce0e070165d3e1e26e5dd4f6c75f2

    • SHA1

      c9c6facf267c095e39ef326bb80807af1e1245cd

    • SHA256

      9a7cd4edc556f074d7454b4946a72df8381eb86ab2d736971bcd1fbe782636a7

    • SHA512

      f09314d7c338e45579d9ced7c1704f075eb0724f6c47e6978960bfad7e8a9fbe674b05671f8f539e820ed6762d6689ab2cf48c06d9924523730ec1b88c1b8461

    • SSDEEP

      12288:yUWA3AheuswqKETUfnlnoTWFM34Ps+Nn1UXcpYlI8VDRcaO/XdPWmlj:yUWqisBKPdoTWFMoPs+NucpYK8VlDO/D

    Score
    10/10
    cybergatediscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks