General

  • Target

    21fd7565ae7526421fc5704a3d48e053_JaffaCakes118

  • Size

    781KB

  • Sample

    240703-mbgrzaxfjh

  • MD5

    21fd7565ae7526421fc5704a3d48e053

  • SHA1

    5b3ac140f473ae87b1b19753c2946323e8a63e69

  • SHA256

    1e27d556c1404411e687bce6597d71e8437f36e069db814533f7c75535c90a1b

  • SHA512

    dc425afb3ac77159914f547c5b2862b3bbce1f5ef6a4a226de3debe302f175e2336d062b5a832b8d0b058d3e1329ee8a9b786ac489048282aa5d8d655df81ddc

  • SSDEEP

    24576:W2f8UqLuTc/Ss7zcq7D8yUfARGQ1vDtk0:BfV6u6XQA0Q1Rk0

Malware Config

Extracted

Family

cybergate

Version

v1.05.1

Botnet

remote

C2

heraton.zapto.org:8080

Mutex

WMC465ILW26HXI

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

Targets

    • Target

      21fd7565ae7526421fc5704a3d48e053_JaffaCakes118

    • Size

      781KB

    • MD5

      21fd7565ae7526421fc5704a3d48e053

    • SHA1

      5b3ac140f473ae87b1b19753c2946323e8a63e69

    • SHA256

      1e27d556c1404411e687bce6597d71e8437f36e069db814533f7c75535c90a1b

    • SHA512

      dc425afb3ac77159914f547c5b2862b3bbce1f5ef6a4a226de3debe302f175e2336d062b5a832b8d0b058d3e1329ee8a9b786ac489048282aa5d8d655df81ddc

    • SSDEEP

      24576:W2f8UqLuTc/Ss7zcq7D8yUfARGQ1vDtk0:BfV6u6XQA0Q1Rk0

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks