cybergate | 63a3fc96d708c941e5e58ea1d34210fda4c9e793e13d4bd0e3f263ca32076e99 | Triage

Submit
Reports

Overview

overview

Static

static

be647fe537...18.exe

windows7-x64

be647fe537...18.exe

windows10-2004-x64

Sharing

General

Target

be647fe537abd6eb65a521d41dd954d1_JaffaCakes118
Size

283KB
Sample

241203-vqm7asvlgv
MD5

be647fe537abd6eb65a521d41dd954d1
SHA1

bffd71951f90713fac5bdd714c6dc0d44e577296
SHA256

63a3fc96d708c941e5e58ea1d34210fda4c9e793e13d4bd0e3f263ca32076e99
SHA512

358817e488a0e7710566574264e7b2fdce1c0769fedd4d470701d325fa6b92d5fd9979e9082676b87a93f623c8815f7e666140dea1c9ea3da437169c4a2e4e4b
SSDEEP

6144:N4ABFs4opAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXK0:WUvGLE0kuGnESB0

Score

10^/10

cybergate discovery persistence stealer trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

be647fe537abd6eb65a521d41dd954d1_JaffaCakes118.exe

Resource

win7-20240729-en

cybergate discovery persistence stealer trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

be647fe537abd6eb65a521d41dd954d1_JaffaCakes118.exe

Resource

win10v2004-20241007-en

cybergate discovery stealer trojan

windows10-2004-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  
  be647fe537abd6eb65a521d41dd954d1_JaffaCakes118
- Size
  
  283KB
- MD5
  
  be647fe537abd6eb65a521d41dd954d1
- SHA1
  
  bffd71951f90713fac5bdd714c6dc0d44e577296
- SHA256
  
  63a3fc96d708c941e5e58ea1d34210fda4c9e793e13d4bd0e3f263ca32076e99
- SHA512
  
  358817e488a0e7710566574264e7b2fdce1c0769fedd4d470701d325fa6b92d5fd9979e9082676b87a93f623c8815f7e666140dea1c9ea3da437169c4a2e4e4b
- SSDEEP
  
  6144:N4ABFs4opAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXK0:WUvGLE0kuGnESB0
Score

10^/10

cybergate discovery persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cybergatediscoverypersistencestealertrojanupx

behavioral2

cybergatediscoverystealertrojan

© 2018-2025

Terms | Privacy