cybergate | 21851c40c10c3bae3e49f0c4937f560857a77577e9f71a6228db4cdf897c7aeb

General

Target

969f905b697b119816dedb2a823d4c04_JaffaCakes118
Size

307KB
Sample

241124-xpff6szpcm
MD5

969f905b697b119816dedb2a823d4c04
SHA1

20f219f5923e889a0b3ed4e3a1bd01ec274293f6
SHA256

21851c40c10c3bae3e49f0c4937f560857a77577e9f71a6228db4cdf897c7aeb
SHA512

e4f6c2cd23ae5090409cf4f4d6b7a44d1ab3b559df3099ed9f6cd887678a9c49ef7a13ec518b5fd9b96562e6b06b141fde49747ea504111415eb475d3129f060
SSDEEP

6144:g1hEoEZkwm4sueAxV7D1dzmRVOacx9iFm4v49aeM1A:gDjakAs1Axl1dtVx9iFeM1A

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

127.0.0.1:81

Mutex

***MUTEX***

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234

Targets

- Target
  
  969f905b697b119816dedb2a823d4c04_JaffaCakes118
- Size
  
  307KB
- MD5
  
  969f905b697b119816dedb2a823d4c04
- SHA1
  
  20f219f5923e889a0b3ed4e3a1bd01ec274293f6
- SHA256
  
  21851c40c10c3bae3e49f0c4937f560857a77577e9f71a6228db4cdf897c7aeb
- SHA512
  
  e4f6c2cd23ae5090409cf4f4d6b7a44d1ab3b559df3099ed9f6cd887678a9c49ef7a13ec518b5fd9b96562e6b06b141fde49747ea504111415eb475d3129f060
- SSDEEP
  
  6144:g1hEoEZkwm4sueAxV7D1dzmRVOacx9iFm4v49aeM1A:gDjakAs1Axl1dtVx9iFeM1A
Score

10^/10

cybergate vítima discovery stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Cybergate family

Checks computer location settings

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2