cybergate | c683c10fcee1606d7428d930183b074ffdcf478bb475b90bf99ae6fec0d250ee | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

d340ecc0ee...18.exe

windows7-x64

d340ecc0ee...18.exe

windows10-2004-x64

Sharing

General

Target

d340ecc0ee373f492000845659e4e07e_JaffaCakes118
Size

276KB
Sample

241207-x7vc2svlan
MD5

d340ecc0ee373f492000845659e4e07e
SHA1

c94c10fbb327c33d02a1a1ae17e2e3cbde083707
SHA256

c683c10fcee1606d7428d930183b074ffdcf478bb475b90bf99ae6fec0d250ee
SHA512

28d460879ec89d29a839818fc2239f5ad0490491b6a1217f1b169c2b967aa9c593568e57b4d8936395486bc3be42a8ad5a6b679350333c5c404a473d205ed829
SSDEEP

6144:gk4qm9kiCeMZZKCqIwszZAHbc8aaFkcG8t/juSWoEu3YnQ:b9yDMr5tzZFhaFPGM7WY3Y

Score

10^/10

cybergate server discovery persistence stealer trojan upx

Static task

static1

upx server cybergate

3 signatures

Behavioral task

behavioral1

Sample

d340ecc0ee373f492000845659e4e07e_JaffaCakes118.exe

Resource

win7-20241010-en

cybergate server discovery persistence stealer trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

d340ecc0ee373f492000845659e4e07e_JaffaCakes118.exe

Resource

win10v2004-20241007-en

cybergate server discovery persistence stealer trojan upx

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Server

C2

unpn.zapto.org:288

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
spynet
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU

Targets

- Target
  
  d340ecc0ee373f492000845659e4e07e_JaffaCakes118
- Size
  
  276KB
- MD5
  
  d340ecc0ee373f492000845659e4e07e
- SHA1
  
  c94c10fbb327c33d02a1a1ae17e2e3cbde083707
- SHA256
  
  c683c10fcee1606d7428d930183b074ffdcf478bb475b90bf99ae6fec0d250ee
- SHA512
  
  28d460879ec89d29a839818fc2239f5ad0490491b6a1217f1b169c2b967aa9c593568e57b4d8936395486bc3be42a8ad5a6b679350333c5c404a473d205ed829
- SSDEEP
  
  6144:gk4qm9kiCeMZZKCqIwszZAHbc8aaFkcG8t/juSWoEu3YnQ:b9yDMr5tzZFhaFPGM7WY3Y
Score

10^/10

cybergate server discovery persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

upxservercybergate

behavioral1

cybergateserverdiscoverypersistencestealertrojanupx

behavioral2

cybergateserverdiscoverypersistencestealertrojanupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.