Overview

overview

10

Static

static

3

2a14c9c147...18.exe

windows7-x64

10

2a14c9c147...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2a14c9c14700ff874c6945f471df7452_JaffaCakes118

  • Size

    759KB

  • Sample

    240707-2ymdaszhqj

  • MD5

    2a14c9c14700ff874c6945f471df7452

  • SHA1

    62365f5cb3d0dbeb0d0abe59997ff40b29fa4c5d

  • SHA256

    7d3f633a775aae62503ba637b47672afca334a930966f3c35ac40563155370b2

  • SHA512

    5a0dcee2e4e0fc3414a27642f33c7ca7231e1fcc02dab73f5a1bc9e5597b089979858bf34cca9a30289eeb75c8a12ee991c5c3d9dd9c3055f84002b11395ecaf

  • SSDEEP

    12288:AvvNVRS9xX0WRNR/eFbR83gW6/OT26WdhHtWZHK5ea1kNsCzs+NYbYugE0mz08+6:EvzRSrX0EeZRUp6/4DWdhYxrMssCnNoH

Score
10/10
cybergateremotepersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

wsb52000.no-ip.biz:83

Mutex

JN4GWTFRIVP73T

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    83917400

Targets

    • Target

      2a14c9c14700ff874c6945f471df7452_JaffaCakes118

    • Size

      759KB

    • MD5

      2a14c9c14700ff874c6945f471df7452

    • SHA1

      62365f5cb3d0dbeb0d0abe59997ff40b29fa4c5d

    • SHA256

      7d3f633a775aae62503ba637b47672afca334a930966f3c35ac40563155370b2

    • SHA512

      5a0dcee2e4e0fc3414a27642f33c7ca7231e1fcc02dab73f5a1bc9e5597b089979858bf34cca9a30289eeb75c8a12ee991c5c3d9dd9c3055f84002b11395ecaf

    • SSDEEP

      12288:AvvNVRS9xX0WRNR/eFbR83gW6/OT26WdhHtWZHK5ea1kNsCzs+NYbYugE0mz08+6:EvzRSrX0EeZRUp6/4DWdhYxrMssCnNoH

    Score
    10/10
    cybergateremotepersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks