Overview

overview

10

Static

static

3

JaffaCakes...78.exe

windows7-x64

10

JaffaCakes...78.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_1a203a21170e7f574f7be03b995b3278

  • Size

    356KB

  • Sample

    250123-xg5fbsyrcz

  • MD5

    1a203a21170e7f574f7be03b995b3278

  • SHA1

    336ae549fb73fd30ec1ba31be20e39b6e011a4df

  • SHA256

    4b986298fff8267d91f514f72cb7d4faf6f790c3e4515b7d48f436c9cfcd4c81

  • SHA512

    2e3249fa6ab06e52829fa14df38132c17fcfa7e60f4cebd1b639b5998d37cef96494d32314bd74e5c525a40071ed024918192cc9da1c35c2f0126d919ffad16d

  • SSDEEP

    6144:j04IUmuXjCCKRS10mQ3/FVyhjN4CFN6f41wOStOuezQA8bp94blkfjnuPHW2J1cr:PIUmm6S1BPhj/6UbuXA47unVtSV

Score
10/10
cybergateno funny no moneydiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

No funny no money

C2

lord00008.no-ip.biz:83

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install32

  • install_file

    server32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      JaffaCakes118_1a203a21170e7f574f7be03b995b3278

    • Size

      356KB

    • MD5

      1a203a21170e7f574f7be03b995b3278

    • SHA1

      336ae549fb73fd30ec1ba31be20e39b6e011a4df

    • SHA256

      4b986298fff8267d91f514f72cb7d4faf6f790c3e4515b7d48f436c9cfcd4c81

    • SHA512

      2e3249fa6ab06e52829fa14df38132c17fcfa7e60f4cebd1b639b5998d37cef96494d32314bd74e5c525a40071ed024918192cc9da1c35c2f0126d919ffad16d

    • SSDEEP

      6144:j04IUmuXjCCKRS10mQ3/FVyhjN4CFN6f41wOStOuezQA8bp94blkfjnuPHW2J1cr:PIUmm6S1BPhj/6UbuXA47unVtSV

    Score
    10/10
    cybergateno funny no moneydiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks