Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...c8.exe

windows7-x64

10

JaffaCakes...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8

  • Size

    289KB

  • MD5

    6f7805f24b63fbec84b83dfc3b1190c8

  • SHA1

    49d35e7ab1c5eb0ed714c0b0421054dce333ab2c

  • SHA256

    2acb8795c2da3c0b117cc30bf9d12156464371abad53bb486f858c1dc74d7975

  • SHA512

    fbd8e1c95c42bdf9da126fa4489c085006540f915d66ca57189649a658c69cf6b9b233e93aa1cb6374949ff81e3d19f80162064f5fa0638abb14638baaa7b099

  • SSDEEP

    6144:D/G0N63UDkF+88uszQAzrUnYkxe81AN9PShCpD6vvBnB1Hxbt:Dx6Kusyn3oeAN5CvBTHH

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.00.1

Botnet

remote

C2

127.0.0.1:999

Mutex

CyberGate1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.