Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...fa.exe

windows7-x64

10

JaffaCakes...fa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_87c0165d80dcb59f6b37840ae4f167fa

  • Size

    267KB

  • MD5

    87c0165d80dcb59f6b37840ae4f167fa

  • SHA1

    7e4eee49d395160d4f1efa43335d9c49c0b2a9f1

  • SHA256

    2461e4b4ce374b7d48c8a8110e37cd2c0114c4718b0728956244573d18ce5559

  • SHA512

    515a9c4db5ab2657bbc7e8c00d4d02feaf5afd8f727c7722d0adf63779b9c3fe677f53a94761d8da5b58e9fb685ede82641d4011fa31e34ac7d97b0a231e1971

  • SSDEEP

    6144:5kTVAEU7Xq/aKDqBM3XjqWr/DZLrACAC2IR3Vtli5N7ZEO6G0rLvRB:efuqiKD2MjvrLZL/97QNGO6bv

Score
10/10
upxlammercybergate

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Lammer

C2

kitohacking1.no-ip.org:82

Mutex

Pluguin

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft2

  • install_file

    Pluguin.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.

  • message_box_title

    LAMMER

  • password

    kito

  • regkey_hkcu

    Win32

  • regkey_hklm

    Win32

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_87c0165d80dcb59f6b37840ae4f167fa
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.