Overview

overview

10

Static

static

3

9a750afab8...18.exe

windows7-x64

10

9a750afab8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9a750afab82a2fecd93a58d9294858f2_JaffaCakes118

  • Size

    444KB

  • Sample

    241125-ksq1vsvkhn

  • MD5

    9a750afab82a2fecd93a58d9294858f2

  • SHA1

    a6e8bfec5d1bda1c7d1e7062a8062464d42f92e2

  • SHA256

    e9e2672c41597d2ece0d3c50c659245a5c82855caf8feb79547169e4aac30f62

  • SHA512

    281e2ba89b6aa03f745e4fb5704848b6b9638560b018278a4caa5246679effc540135a5fead3f821e62c31d05c520b00fc72eb1144cc0753e2363709ebdd7a97

  • SSDEEP

    12288:NAtA/aG0k4keYngaqwLAYpksDIyvscVhKy:OtA/5vFn1qwLLpkQv/D

Score
10/10
cybergateremotediscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

remote

C2

hostt.no-ip.info:8080

serverrat.no-ip.org:8080

testmachine.dontexist.com:8080
Mutex

I00G5XR188SQV4

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    iexplorer.exe

  • install_dir

    Microsoft Live

  • install_file

    Microsoft Live.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    .NET Framework Initialization Error: C:\WINDOWS\ Microsoft.NET\Framework\v 1.1.4322\Mscorwks.dll could not be loaded. An unhandled exception has occurred in a component in your application.

  • message_box_title

    .NET Framework

  • password

    1048

  • regkey_hkcu

    Microsoft Live

Targets

    • Target

      9a750afab82a2fecd93a58d9294858f2_JaffaCakes118

    • Size

      444KB

    • MD5

      9a750afab82a2fecd93a58d9294858f2

    • SHA1

      a6e8bfec5d1bda1c7d1e7062a8062464d42f92e2

    • SHA256

      e9e2672c41597d2ece0d3c50c659245a5c82855caf8feb79547169e4aac30f62

    • SHA512

      281e2ba89b6aa03f745e4fb5704848b6b9638560b018278a4caa5246679effc540135a5fead3f821e62c31d05c520b00fc72eb1144cc0753e2363709ebdd7a97

    • SSDEEP

      12288:NAtA/aG0k4keYngaqwLAYpksDIyvscVhKy:OtA/5vFn1qwLLpkQv/D

    Score
    10/10
    cybergateremotediscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks