cybergate | be64588a0a2153aca54f18f81ce3720b0c6df9d1b844eba34ba2cafe509ad81f

General

Target
5eb8d13f487019cbcf71762fa3592e1a_JaffaCakes118.exe
Size 1.2MB
Sample240720-c6fs2swele
SHA256 be64588a0a2153aca54f18f81ce3720b0c6df9d1b844eba34ba2cafe509ad81f
MD5 5eb8d13f487019cbcf71762fa3592e1a
SHA1 9529e3c0b94b53db342ca6b00e6491bd73327ae1
SHA512 df620910329236d3e5a3957e20d306ff3803b3c2f7fe8e4c6b03b497822e2e76786c8e1e0f504017c249c248c581456dba95c5572849b1ed751dc3291d8cbf81
SSDEEP 24576:1nJjkPyZvj0V4cx4riwWu0LE/kuZBSgy9c8VbXjM8XZw/i:1JjhZb0V4cwKw/kuZBSgy9cqbzMwEi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

marwan19.no-ip.biz:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	5eb8d13f487019cbcf71762fa3592e1a_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
3296	CryptedServer.exe
1204	7za.exe
3740	Server.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000234af-27.dat	upx
behavioral2/memory/3740-29-0x0000000000400000-0x0000000000457200-memory.dmp	upx
behavioral2/memory/3740-30-0x0000000000400000-0x0000000000457200-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4188	3740	WerFault.exe	98

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3296	4176	5eb8d13f487019cbcf71762fa3592e1a_JaffaCakes118.exe	94
PID 4176 wrote to memory of 3296	4176	5eb8d13f487019cbcf71762fa3592e1a_JaffaCakes118.exe	94
PID 4176 wrote to memory of 3296	4176	5eb8d13f487019cbcf71762fa3592e1a_JaffaCakes118.exe	94
PID 3296 wrote to memory of 2416	3296	CryptedServer.exe	95
PID 3296 wrote to memory of 2416	3296	CryptedServer.exe	95
PID 3296 wrote to memory of 2416	3296	CryptedServer.exe	95
PID 2416 wrote to memory of 1204	2416	cmd.exe	97
PID 2416 wrote to memory of 1204	2416	cmd.exe	97
PID 2416 wrote to memory of 1204	2416	cmd.exe	97
PID 3296 wrote to memory of 3740	3296	CryptedServer.exe	98
PID 3296 wrote to memory of 3740	3296	CryptedServer.exe	98
PID 3296 wrote to memory of 3740	3296	CryptedServer.exe	98

C:\Users\Admin\AppData\Local\Temp\5eb8d13f487019cbcf71762fa3592e1a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5eb8d13f487019cbcf71762fa3592e1a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4176
- C:\CryptedServer.exe
  "C:\CryptedServer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\7za.exe" "x" "-y" "C:\Users\Admin\AppData\Roaming\Server.7z" "-pSaltyDave""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Users\Admin\AppData\Roaming\7za.exe
      "C:\Users\Admin\AppData\Roaming\7za.exe" "x" "-y" "C:\Users\Admin\AppData\Roaming\Server.7z" "-pSaltyDave"
      4⤵
      Executes dropped EXE
      PID:1204
- - C:\Users\Admin\AppData\Roaming\Server.exe
    C:\Users\Admin\AppData\Roaming\Server.exe
    3⤵
    - Executes dropped EXE
    PID:3740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 224
      4⤵
      Program crash
      PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3740 -ip 3740
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CryptedServer.exe

Path C:\CryptedServer.exe
Size 1.1MB
SHA256 7387389b94d473d7af3d2ac130f024c268723f534f33122d1a32f7063c7f0e2f
MD5 514ea6821a66125f8f0f55dbcc6c10cc
SHA1 f1a61823035af46ef199e6eadedd80ca141c2753
SHA512 d5ce83c89cd8682c360fa15ae33d02c7e492d3213a7cb570058b2b9ed41da2725f0ddb7e640c08d88157b326cfe8a3496417de12d8d902a7510eaeaa5e2ba635
SSDEEP 24576:lPGSY91VwNJcFMqTwo4zMyMPy+mfeK15bSGm5ty+Oo3:tGJyVjo4zKWfecFST5tqo3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Roaming\7za.exe
Size 574KB
SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
MD5 42badc1d2f03a8b1e4875740d3d49336
SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.7z

Path C:\Users\Admin\AppData\Roaming\Server.7z
Size 265KB
SHA256 44102518613d2ff4135c932096928f581d8e6d8b755a46e3a5c4140f05ed74a9
MD5 4eab873eb1e16c20c791272aa7cb7f1c
SHA1 d9273f00019293b2db07ae5376dceb5717261b6b
SHA512 943219cc1236806092ab57923b7e07882502cc451f4346b9d0cbc1a06c9cc15ed766ce181e26f0313ec39a0907dd3e993b2e9f8de3796e703923cc7307f600d6
SSDEEP 6144:GbxuKJeCkHOm4TWJSq9bfTs7ZY89jJCmNRFfULoj:GbxuKsjuWJP9bbstjJCmNRFMLoj
MD5 SHA1 SHA512 SSDEEP

Submit Download

server.exe

Path C:\server.exe
Size 348KB
SHA256 914b9acf079fa67d5b67f24ba7d2197906848e834b491b4a804666f70d289ecb
MD5 778eed51e8a5dcddbc71f69cae4cb0aa
SHA1 97bacd79b0fa686c3d881b9972155f27c28fafd2
SHA512 24a4cebba891126f9b61b9426e226f8f4807d4388f3f995b5afd1441ec271ef91eefeee23a2b3ec89d7320d943d2df30e1d6b3af5f29cab68e29c465bfd3b6f9
SSDEEP 6144:lAk4qmYJwW1aFDvX68Krq96yd6ZHyq13jglrzXn0iB:x97AFjXkxsmdzyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3740-29-0x0000000000400000-0x0000000000457200-memory.dmp

Download

memory/3740-30-0x0000000000400000-0x0000000000457200-memory.dmp

Download

memory/4176-4-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4176-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads