Overview

overview

10

Static

static

3

b93788b56b...18.exe

windows7-x64

10

b93788b56b...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b93788b56b292165d135633d889af0a6_JaffaCakes118

  • Size

    661KB

  • Sample

    240822-1csshs1fjm

  • MD5

    b93788b56b292165d135633d889af0a6

  • SHA1

    57ebd01f9a545fcffc7568adfa4a981f4de0e24e

  • SHA256

    3238fa708930d912b82d41470ab9688808d4f94abfbffc3ce2c176dd8f95eb2e

  • SHA512

    e30363bbdc2c2cee2f64cdb44535a5e3b31855c8191f4f72f268a6dac20e6eb65f106874bbd59c4cc0715371569d7d52bb93b2e114fb3192359eae28ece91010

  • SSDEEP

    12288:kUyXGYOzkjxesZXncxcRBQZWbnHMyDzAe2nD2POHT5l55gOW:kUyjOzk1esZXOcVHTATb552

Score
10/10
cybergateexcdiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

exc

C2

winupdat.no-ip.org:90

Mutex

X172C623X1HSV7

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    iexplore.exe

  • install_dir

    Microsoft

  • install_file

    wualct.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    int1705

  • regkey_hkcu

    wualct

  • regkey_hklm

    wualct.exe

Targets

    • Target

      b93788b56b292165d135633d889af0a6_JaffaCakes118

    • Size

      661KB

    • MD5

      b93788b56b292165d135633d889af0a6

    • SHA1

      57ebd01f9a545fcffc7568adfa4a981f4de0e24e

    • SHA256

      3238fa708930d912b82d41470ab9688808d4f94abfbffc3ce2c176dd8f95eb2e

    • SHA512

      e30363bbdc2c2cee2f64cdb44535a5e3b31855c8191f4f72f268a6dac20e6eb65f106874bbd59c4cc0715371569d7d52bb93b2e114fb3192359eae28ece91010

    • SSDEEP

      12288:kUyXGYOzkjxesZXncxcRBQZWbnHMyDzAe2nD2POHT5l55gOW:kUyjOzk1esZXOcVHTATb552

    Score
    10/10
    cybergateexcdiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks