General

  • Target

    JaffaCakes118_08cca4579df35d2e7caca412253ab747

  • Size

    485KB

  • Sample

    250524-yk6y1a1mv7

  • MD5

    08cca4579df35d2e7caca412253ab747

  • SHA1

    16f29d54893d5a21ca88e50e562ba20c0f240c06

  • SHA256

    4cb5db5c4fe5d1345a401b36f26d68a1e0bf883da90df05f8ff3fea872f961f2

  • SHA512

    45211ec8aaed772ded97319017c9855ea3a257e273a6c7c739ff4ab4087896ce0e2a2d5b0777cd17aa36d1fd45dfb0b55f6241925677ef3c9f3cf17bf5962dae

  • SSDEEP

    12288:BZc4DoY49DjKvJH8PypCQaZRXFRJbdDuZEoni6:BvvijCvVORZdD8i6

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

remote

C2

zer0xxx1337.zapto.org:200

Mutex

O41RY352EVDBB3

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install32

  • install_file

    explorer.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    ownage123

  • regkey_hkcu

    XNG windows7

  • regkey_hklm

    XNG windows7

Extracted

Family

latentbot

C2

zer0xxx1337.zapto.org

Targets

    • Target

      JaffaCakes118_08cca4579df35d2e7caca412253ab747

    • Size

      485KB

    • MD5

      08cca4579df35d2e7caca412253ab747

    • SHA1

      16f29d54893d5a21ca88e50e562ba20c0f240c06

    • SHA256

      4cb5db5c4fe5d1345a401b36f26d68a1e0bf883da90df05f8ff3fea872f961f2

    • SHA512

      45211ec8aaed772ded97319017c9855ea3a257e273a6c7c739ff4ab4087896ce0e2a2d5b0777cd17aa36d1fd45dfb0b55f6241925677ef3c9f3cf17bf5962dae

    • SSDEEP

      12288:BZc4DoY49DjKvJH8PypCQaZRXFRJbdDuZEoni6:BvvijCvVORZdD8i6

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Cybergate family

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Latentbot family

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks