cybergate | 72a7b98df7e238b2dd4bcd91ad1350c021724437d1476914999ee4163ed80256

General

Target

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Size

223KB
MD5

f8cd90273c440357a5f9f8ee6b3c7c78
SHA1

2e85c539f4829ab1ce991c007b26ea96061c79ef
SHA256

72a7b98df7e238b2dd4bcd91ad1350c021724437d1476914999ee4163ed80256
SHA512

2ebd128abc10dd81b018d633518844569dbe7867ea149be13e7b9057eb1b1a5c0ceaac9c091923b661759c75f6c9d24cebbf23ab7e6a3165ba6c54e7db130f01
SSDEEP

6144:wb0tCeLEdfoM6+/iXyrr/5UteUiUtCJHMqsEjR55j30s03NkLIiuTfir:htCeLEdfoM6+/iXyrr/5hNsI5qDafuTS

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.2.3

Botnet

vítima

C2

yass123.no-ip.biz:3460

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe"	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe"	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "c:\\dir\\install\\install\\server.exe Restart"	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2960-2-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2960-4-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2960-5-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2960-6-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2960-10-0x0000000024010000-0x000000002404E000-memory.dmp	upx
behavioral1/memory/2924-238-0x0000000024050000-0x000000002408E000-memory.dmp	upx
behavioral1/memory/2960-242-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2924-274-0x0000000024050000-0x000000002408E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	pid	process	target process
PID 1624 set thread context of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid process

2960 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid process

2924 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid	process
2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid	process
2924	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2924	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Token: SeDebugPrivilege	2924	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid process

1624 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid	process
1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exef8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	pid	process	target process
PID 1624 wrote to memory of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 1624 wrote to memory of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 1624 wrote to memory of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 1624 wrote to memory of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 1624 wrote to memory of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 1624 wrote to memory of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 1624 wrote to memory of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 1624 wrote to memory of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 1624 wrote to memory of 2960	1624	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 2960 wrote to memory of 1636	2960	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1636

C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
141KB

MD5
d8f89c333d8e68956a48dcb359f34c59

SHA1
1529d7617d233e0bca3717786b653e2e57ff5ec1

SHA256
137ee123ff6a4cef5bdfc30e10df402ec0f85db59b3e2f35d1d34d6861c4959e

SHA512
95b5347f8a055df16c9700fe0bfd59ce00fbb13fa39683e5320b016e0e18d4190e008e29d53265777be9e03f1a7619530116918abd55289eecbd2c544f2c1298

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat
Filesize
15B

MD5
86f3c87caff4d7973404ff22c664505b

SHA1
245bc19c345bc8e73645cd35f5af640bc489da19

SHA256
e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb

SHA512
0940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024

Download Submit
memory/2924-27-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2924-274-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/2924-238-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/2924-14-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2924-20-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2960-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2960-10-0x0000000024010000-0x000000002404E000-memory.dmp

Filesize
248KB

Download
memory/2960-242-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2960-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2960-5-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2960-4-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads