Overview

overview

10

Static

static

10

JaffaCakes...c1.exe

windows7-x64

JaffaCakes...c1.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0f34f46d4bb79ffeef232ce712f5d4c1

  • Size

    215KB

  • Sample

    250221-baxagsyrfn

  • MD5

    0f34f46d4bb79ffeef232ce712f5d4c1

  • SHA1

    02312583b70c190e9e299a108f14e8ea5d4be56a

  • SHA256

    402a6325babb70a9fbc73e9a52a1d0fb2556dc00cb43a5900fcf0dc1ea3f44b2

  • SHA512

    ef318acadb5de8c80ffc65aa12791cb2423ddb0bbbbab690b8e150068f87abb9015a14df519f145aeb81fff45a1bdca4b33c75b7fdf6dc86667712593ba9cd51

  • SSDEEP

    6144:cRjC+LsxZZQttyCVxaWYSda4bHPS9x6qr6jDRPWS:Gj5eAtpVxag1bvgx6Ndx

Score
10/10
cybergateremote

Malware Config

Extracted

Family

cybergate

Version

v1.03.0

Botnet

remote

C2

127.0.0.1:7777

playboy.zapto.org:7777
Mutex

N00I75A85X3H3J

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WindowsUpdate

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      JaffaCakes118_0f34f46d4bb79ffeef232ce712f5d4c1

    • Size

      215KB

    • MD5

      0f34f46d4bb79ffeef232ce712f5d4c1

    • SHA1

      02312583b70c190e9e299a108f14e8ea5d4be56a

    • SHA256

      402a6325babb70a9fbc73e9a52a1d0fb2556dc00cb43a5900fcf0dc1ea3f44b2

    • SHA512

      ef318acadb5de8c80ffc65aa12791cb2423ddb0bbbbab690b8e150068f87abb9015a14df519f145aeb81fff45a1bdca4b33c75b7fdf6dc86667712593ba9cd51

    • SSDEEP

      6144:cRjC+LsxZZQttyCVxaWYSda4bHPS9x6qr6jDRPWS:Gj5eAtpVxag1bvgx6Ndx

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks