cybergate | cf422a4a354a573819db359d71d2324990964ad9167a55f032b4774210a48fce

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0d467b7ca90e2b2f1e06830759f49bc_JaffaCakes118.exe
Size

247KB
MD5

d0d467b7ca90e2b2f1e06830759f49bc
SHA1

7016196586a1a919f05b46a752249ab1f2991373
SHA256

cf422a4a354a573819db359d71d2324990964ad9167a55f032b4774210a48fce
SHA512

751d754944499ca2fdc1aa26b3996c6d31207b5ea1f2c1878358bc28d3085057d9e3215fef794f81407378fafb052be18cbab8c06b3c02bf2f9ea69ec711c898
SSDEEP

6144:mtlMAw/WOe0sr/lHrGxTMOgaD4CnAiRbm2+8gI:Ml9w/oplrGxjGCnAitm2+8g

Score

10^/10

cybergate remote discovery stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.05.1

Botnet

remote

192.168.1.65:95

Mutex

7N5845MWQQV413

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
windows
install_file
svchost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
azerty

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	2264	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0d467b7ca90e2b2f1e06830759f49bc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2412	2264	d0d467b7ca90e2b2f1e06830759f49bc_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2412	2264	d0d467b7ca90e2b2f1e06830759f49bc_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2412	2264	d0d467b7ca90e2b2f1e06830759f49bc_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2412	2264	d0d467b7ca90e2b2f1e06830759f49bc_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d0d467b7ca90e2b2f1e06830759f49bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0d467b7ca90e2b2f1e06830759f49bc_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 160
  2⤵
  - Program crash
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download