Overview

overview

10

Static

static

3

JaffaCakes...1e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e

  • Size

    808KB

  • Sample

    250409-dpn9jaxqx4

  • MD5

    a2f8b0ed4ab2da1fb141a4c459fb621e

  • SHA1

    30168bf5b25fae36c0f7d314351f114204dc75ed

  • SHA256

    7097c1b6043856989e99f119d42f39ad846f0c0ea3532e1072eb7a3c5a629274

  • SHA512

    b82560305438d490602d1b55639d28008af42e1604204fb0eec3f37052d60119a3b86ce2e31df706d1eb97165434bd11ce8b0f84fc50991e8f139dfa724b25fb

  • SSDEEP

    12288:eytN/T3n36vreofZ84s1JqEDLNZmdexJzMwtCGXvYFsLJtgxZ9am+qqGSz1eGRj2:eoXom1XRUWWQEgj2NE5

Score
10/10
cybergatecyberdiscoverystealertrojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

cyber

C2

127.0.0.1:82

glider.no-ip.biz:82
Mutex

21C55QTSN11T42

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WinLogon

  • install_file

    WinLogon.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    alomhack

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e

    • Size

      808KB

    • MD5

      a2f8b0ed4ab2da1fb141a4c459fb621e

    • SHA1

      30168bf5b25fae36c0f7d314351f114204dc75ed

    • SHA256

      7097c1b6043856989e99f119d42f39ad846f0c0ea3532e1072eb7a3c5a629274

    • SHA512

      b82560305438d490602d1b55639d28008af42e1604204fb0eec3f37052d60119a3b86ce2e31df706d1eb97165434bd11ce8b0f84fc50991e8f139dfa724b25fb

    • SSDEEP

      12288:eytN/T3n36vreofZ84s1JqEDLNZmdexJzMwtCGXvYFsLJtgxZ9am+qqGSz1eGRj2:eoXom1XRUWWQEgj2NE5

    Score
    10/10
    cybergatecyberdiscoverystealertrojan

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks