Overview

overview

10

Static

static

3

098c8b2d91...18.exe

windows7-x64

10

098c8b2d91...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    098c8b2d911df036193a6ea91e054365_JaffaCakes118

  • Size

    288KB

  • Sample

    240624-tsxyva1eqe

  • MD5

    098c8b2d911df036193a6ea91e054365

  • SHA1

    43d082770cb441cdeeb02733f9c2ef4c2e4174bc

  • SHA256

    7968445961d64377925b05a96b3e0166840c649f1bbec9d6f5fa874a31800b76

  • SHA512

    d469350ea810de4e17067291ea71588d21f714cd6060a6c92e279385ee85d0f3410bea07d60c28b1d00270652feaf2206eb53ad11393941bd3e877d91329db09

  • SSDEEP

    6144:BncgXp4lsEkrRN0TBC88qxDSuGxjffQFUHifpLCxsjNq+eY27OL:ZHpEk16TBb8qZIB7xshqt7OL

Score
10/10
cybergatevítimastealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

127.0.0.1:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Targets

    • Target

      098c8b2d911df036193a6ea91e054365_JaffaCakes118

    • Size

      288KB

    • MD5

      098c8b2d911df036193a6ea91e054365

    • SHA1

      43d082770cb441cdeeb02733f9c2ef4c2e4174bc

    • SHA256

      7968445961d64377925b05a96b3e0166840c649f1bbec9d6f5fa874a31800b76

    • SHA512

      d469350ea810de4e17067291ea71588d21f714cd6060a6c92e279385ee85d0f3410bea07d60c28b1d00270652feaf2206eb53ad11393941bd3e877d91329db09

    • SSDEEP

      6144:BncgXp4lsEkrRN0TBC88qxDSuGxjffQFUHifpLCxsjNq+eY27OL:ZHpEk16TBb8qZIB7xshqt7OL

    Score
    10/10
    cybergatevítimastealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks