Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...3e.exe

windows7-x64

10

JaffaCakes...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8536543055d995c18a5fe98e3a25dc3e

  • Size

    328KB

  • Sample

    250321-3zwtssxmx5

  • MD5

    8536543055d995c18a5fe98e3a25dc3e

  • SHA1

    532bea6e4db8b6f7b190bbb21fb478b44effb64e

  • SHA256

    3216b135a85244846616a4e6ef906aede7176ca10ef947f41a23bcb5f1550180

  • SHA512

    2859006e8f85081f5ad7418177f29dfad87a9784ff4016f6921f6800a2a308146e3650b4f20c2ef9fd7a1c916cb80a501d92af7b7e487ce5fe69c7a478e25bf1

  • SSDEEP

    6144:lbZQS2NtBzK0+pRRSyHgAiVnS2f9BeMHs5LhEY+YXBL+bffAgboR82BvWnlJ:L2fBsRSyAdnXfiTZ+YXBL+bfdh2C

Score
10/10
cybergater'séïïßö÷»údiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

R'sÉÏÏßÖ÷»ú

C2

softdiyers.vicp.net:3030

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    newsway

  • install_file

    newswayexe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    ÕâÊÇÀ´×ÔÓÚRover12421µÄÎʺò£¡

  • message_box_title

    Hello World!

  • password

    abcd1234

  • regkey_hklm

    newsway

Targets

    • Target

      JaffaCakes118_8536543055d995c18a5fe98e3a25dc3e

    • Size

      328KB

    • MD5

      8536543055d995c18a5fe98e3a25dc3e

    • SHA1

      532bea6e4db8b6f7b190bbb21fb478b44effb64e

    • SHA256

      3216b135a85244846616a4e6ef906aede7176ca10ef947f41a23bcb5f1550180

    • SHA512

      2859006e8f85081f5ad7418177f29dfad87a9784ff4016f6921f6800a2a308146e3650b4f20c2ef9fd7a1c916cb80a501d92af7b7e487ce5fe69c7a478e25bf1

    • SSDEEP

      6144:lbZQS2NtBzK0+pRRSyHgAiVnS2f9BeMHs5LhEY+YXBL+bffAgboR82BvWnlJ:L2fBsRSyAdnXfiTZ+YXBL+bfdh2C

    Score
    10/10
    cybergater'séïïßö÷»údiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks