General
-
Target
JaffaCakes118_08cca4579df35d2e7caca412253ab747
-
Size
485KB
-
Sample
250524-yk6y1a1mv7
-
MD5
08cca4579df35d2e7caca412253ab747
-
SHA1
16f29d54893d5a21ca88e50e562ba20c0f240c06
-
SHA256
4cb5db5c4fe5d1345a401b36f26d68a1e0bf883da90df05f8ff3fea872f961f2
-
SHA512
45211ec8aaed772ded97319017c9855ea3a257e273a6c7c739ff4ab4087896ce0e2a2d5b0777cd17aa36d1fd45dfb0b55f6241925677ef3c9f3cf17bf5962dae
-
SSDEEP
12288:BZc4DoY49DjKvJH8PypCQaZRXFRJbdDuZEoni6:BvvijCvVORZdD8i6
Behavioral task
behavioral1
Sample
JaffaCakes118_08cca4579df35d2e7caca412253ab747.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
JaffaCakes118_08cca4579df35d2e7caca412253ab747.exe
Resource
win11-20250502-en
Malware Config
Extracted
cybergate
v3.4.2.2
remote
zer0xxx1337.zapto.org:200
O41RY352EVDBB3
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install32
-
install_file
explorer.exe
-
install_flag
false
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
ownage123
-
regkey_hkcu
XNG windows7
-
regkey_hklm
XNG windows7
Extracted
latentbot
zer0xxx1337.zapto.org
Targets
-
-
Target
JaffaCakes118_08cca4579df35d2e7caca412253ab747
-
Size
485KB
-
MD5
08cca4579df35d2e7caca412253ab747
-
SHA1
16f29d54893d5a21ca88e50e562ba20c0f240c06
-
SHA256
4cb5db5c4fe5d1345a401b36f26d68a1e0bf883da90df05f8ff3fea872f961f2
-
SHA512
45211ec8aaed772ded97319017c9855ea3a257e273a6c7c739ff4ab4087896ce0e2a2d5b0777cd17aa36d1fd45dfb0b55f6241925677ef3c9f3cf17bf5962dae
-
SSDEEP
12288:BZc4DoY49DjKvJH8PypCQaZRXFRJbdDuZEoni6:BvvijCvVORZdD8i6
-
Cybergate family
-
Latentbot family
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-