Overview

overview

10

Static

static

3

c9b5779e50...18.exe

windows7-x64

10

c9b5779e50...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9b5779e50b112068d89667ecc0f5cf3_JaffaCakes118

  • Size

    424KB

  • Sample

    241205-2kre4avrdy

  • MD5

    c9b5779e50b112068d89667ecc0f5cf3

  • SHA1

    71fccbe957673aa7d843bc9790100da255d41efd

  • SHA256

    920a57771487b695c50a0d4e7de03b643aeb1bc9c9665e070dab8a9e4f9a0ed0

  • SHA512

    e2f7740382016c47b7389756f42edd3620b1a973cdfa508850879652cf2923aa64f64bc980e52c12d8658831ea257464f1e88daf56832f685842821d0b11bd2d

  • SSDEEP

    12288:GBPWmlLrWNwOzlNQoGiDjLsXqKiuPsTnl:GBemlLKyUNQPCuQn

Score
10/10
cybergatepub_b85pudiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

pub_b85pu

C2

b85pu.effers.com:40123

Mutex

I711HG47LT74L5

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    iexplorer.exe

  • install_dir

    Intel

  • install_file

    cfg.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    fiction

  • regkey_hkcu

    Intel

Targets

    • Target

      c9b5779e50b112068d89667ecc0f5cf3_JaffaCakes118

    • Size

      424KB

    • MD5

      c9b5779e50b112068d89667ecc0f5cf3

    • SHA1

      71fccbe957673aa7d843bc9790100da255d41efd

    • SHA256

      920a57771487b695c50a0d4e7de03b643aeb1bc9c9665e070dab8a9e4f9a0ed0

    • SHA512

      e2f7740382016c47b7389756f42edd3620b1a973cdfa508850879652cf2923aa64f64bc980e52c12d8658831ea257464f1e88daf56832f685842821d0b11bd2d

    • SSDEEP

      12288:GBPWmlLrWNwOzlNQoGiDjLsXqKiuPsTnl:GBemlLKyUNQPCuQn

    Score
    10/10
    cybergatepub_b85pudiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks