Overview

overview

10

Static

static

3

d6618b8196...18.exe

windows7-x64

10

d6618b8196...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6618b8196e9dfd7a87758c0c203e95e_JaffaCakes118

  • Size

    558KB

  • Sample

    241208-ljx89azkhv

  • MD5

    d6618b8196e9dfd7a87758c0c203e95e

  • SHA1

    51d87a3e2b3ce9f4aabf8eead39bd379a9422559

  • SHA256

    b44be3633c47c6384b2bee98f38041cf976310e2e686d1356fb2bdd1ae2e48a9

  • SHA512

    71e357ddb5d04baa1ce207a3876f6f7a8efae90dfbb11b8a9e3582664847042717cae41ffb4202309889106ceb6bf9ca3b0d8d206baca123672f5b54f7231788

  • SSDEEP

    12288:TUM+ZZMGK9qU35U3fZ42JvQqV6ka05mLcjMqYQnFqi1jRPw0zaWdNqhAIoNMj:4Ga97V31kIy

Score
10/10
cybergateremotediscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

127.0.0.1:82

testiurl.no-ip.biz:82
Mutex

XJH6V3VRR35828

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Svchost

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

Targets

    • Target

      d6618b8196e9dfd7a87758c0c203e95e_JaffaCakes118

    • Size

      558KB

    • MD5

      d6618b8196e9dfd7a87758c0c203e95e

    • SHA1

      51d87a3e2b3ce9f4aabf8eead39bd379a9422559

    • SHA256

      b44be3633c47c6384b2bee98f38041cf976310e2e686d1356fb2bdd1ae2e48a9

    • SHA512

      71e357ddb5d04baa1ce207a3876f6f7a8efae90dfbb11b8a9e3582664847042717cae41ffb4202309889106ceb6bf9ca3b0d8d206baca123672f5b54f7231788

    • SSDEEP

      12288:TUM+ZZMGK9qU35U3fZ42JvQqV6ka05mLcjMqYQnFqi1jRPw0zaWdNqhAIoNMj:4Ga97V31kIy

    Score
    10/10
    cybergateremotediscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks