Overview

overview

10

Static

static

3

JaffaCakes...a4.exe

windows7-x64

10

JaffaCakes...a4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_259430c654af26fb6ba7ce9521e4eba4

  • Size

    1.3MB

  • Sample

    250124-1d9seszkhv

  • MD5

    259430c654af26fb6ba7ce9521e4eba4

  • SHA1

    8209bf35c10a6239cd257bb2a8aec37b7d183d33

  • SHA256

    8029e06b2fca551ac8b5d2d52270e7342fa1c0d1c4ed91d14cae4c484819fb22

  • SHA512

    275d2bd889008e0d2635cbfca2b29a7fbd52015e47a8a9ba076e8842d9a49afd98942732764a65a1c2a0bab51f888d81612844b48ad9d96fc8a62897e7e66b8c

  • SSDEEP

    24576:Nsfyf8kXSiOqwvJBFpG05rg49bxxBDik4PH9mljrXqdWXJT8xieB3gNbrSeDZ:+qftX6qwvJXpG0K49bH9ik4PHwl3a0eU

Score
10/10
cybergatedarkcometrodimusdiscoverypersistenceratstealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Rodimus

C2

rodnew.no-ip.info:100

Mutex

1NFWCNUQ1VQ33Y

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    polska

Targets

    • Target

      JaffaCakes118_259430c654af26fb6ba7ce9521e4eba4

    • Size

      1.3MB

    • MD5

      259430c654af26fb6ba7ce9521e4eba4

    • SHA1

      8209bf35c10a6239cd257bb2a8aec37b7d183d33

    • SHA256

      8029e06b2fca551ac8b5d2d52270e7342fa1c0d1c4ed91d14cae4c484819fb22

    • SHA512

      275d2bd889008e0d2635cbfca2b29a7fbd52015e47a8a9ba076e8842d9a49afd98942732764a65a1c2a0bab51f888d81612844b48ad9d96fc8a62897e7e66b8c

    • SSDEEP

      24576:Nsfyf8kXSiOqwvJBFpG05rg49bxxBDik4PH9mljrXqdWXJT8xieB3gNbrSeDZ:+qftX6qwvJXpG0K49bH9ik4PHwl3a0eU

    Score
    10/10
    cybergatedarkcometrodimusdiscoverypersistenceratstealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks