cybergate | jaffacakes118_Trojan[.]Win32[.]Llac[.]lgnr[.]8a3b9d378848647b393db37eec0fa049

General

Target
jaffacakes118_Trojan.Win32.Llac.lgnr.8a3b9d378848647b393db37eec0fa049
Size 353KB
Sample261014-me81maff39
SHA256 23ff38d4f7b82db7ea022a844a86bcc5618e4d49847c45607bcebfcaafd8b280
MD5 8a3b9d378848647b393db37eec0fa049
SHA1 b1cbdb50b1f7e7507ca5375279973ef383b1abd2
SHA512 1a314da6702a02c1b4444d2c3386f7f55c024895a59047b4873bd440ef198fcc413e34eeb186bdb9300672780475331ee616e33d9d52327ad8d78c96a1b7efb4
SSDEEP 6144:1mcD66Rw5JGmrpQsK3RD2u270jupCJsCxCXIaPRi:wcD663Z2zkPaCxs
TLSH
T1FD740163DAC4C6BBD2A40EF85D3880A0799D79362D7B159BFADD0F0ED93D0C2690D186
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx öííé trojan stealer cybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

enternet.servehttp.com:288

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_file
windows.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
t?tulo da mensagem
password
abcd1234

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Llac.lgnr.8a3b9d378848647b393db37eec0fa049

File Explorer

jaffacakes118_Trojan.Win32.Llac.lgnr.8a3b9d378848647b393db37eec0fa049

.exe 353KB

jaffacakes118_Trojan.Win32.Llac.lgnr.8a3b9d378848647b393db37eec0fa049

SHA256 23ff38d4f7b82db7ea022a844a86bcc5618e4d49847c45607bcebfcaafd8b280
MD5 8a3b9d378848647b393db37eec0fa049
SHA1 b1cbdb50b1f7e7507ca5375279973ef383b1abd2
SHA512 1a314da6702a02c1b4444d2c3386f7f55c024895a59047b4873bd440ef198fcc413e34eeb186bdb9300672780475331ee616e33d9d52327ad8d78c96a1b7efb4
SSDEEP 6144:1mcD66Rw5JGmrpQsK3RD2u270jupCJsCxCXIaPRi:wcD663Z2zkPaCxs
TLSH
T1FD740163DAC4C6BBD2A40EF85D3880A0799D79362D7B159BFADD0F0ED93D0C2690D186
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

48116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Sharing