Overview

overview

10

Static

static

3

d3b06efdc5...18.exe

windows7-x64

10

d3b06efdc5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3b06efdc54bd3de36223de188623e7b_JaffaCakes118

  • Size

    373KB

  • Sample

    241207-1aw26azmem

  • MD5

    d3b06efdc54bd3de36223de188623e7b

  • SHA1

    4512a17dfd4b52e5f4c13db2a1d9f95136a40620

  • SHA256

    cdf789ec0c00fac253e6c20d4f1fd71986403a88d40514aaa735a5280dc59f18

  • SHA512

    c312c6e848bcdbfb8961f53800ce0c12422a3a255054cf72b66ae7de7c7400f9df6a0b59ccfd492211418e0ebb9789f75f8c51b9d57be1977f9014f7e71146e6

  • SSDEEP

    6144:/RPfgisAsvnZsGz5ZwqNR29EI38U1fX4Ycuns0bebi3prZOEEIvl:RQAI1zPwqm9d8Us0bakZxd

Score
10/10
cybergatenewdiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

new

C2

btcminer.zapto.org:4445

Mutex

2VE53B54036828

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    adobe

  • install_file

    reader.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    362175656

  • regkey_hkcu

    HKCU

Targets

    • Target

      d3b06efdc54bd3de36223de188623e7b_JaffaCakes118

    • Size

      373KB

    • MD5

      d3b06efdc54bd3de36223de188623e7b

    • SHA1

      4512a17dfd4b52e5f4c13db2a1d9f95136a40620

    • SHA256

      cdf789ec0c00fac253e6c20d4f1fd71986403a88d40514aaa735a5280dc59f18

    • SHA512

      c312c6e848bcdbfb8961f53800ce0c12422a3a255054cf72b66ae7de7c7400f9df6a0b59ccfd492211418e0ebb9789f75f8c51b9d57be1977f9014f7e71146e6

    • SSDEEP

      6144:/RPfgisAsvnZsGz5ZwqNR29EI38U1fX4Ycuns0bebi3prZOEEIvl:RQAI1zPwqm9d8Us0bakZxd

    Score
    10/10
    cybergatenewdiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks