cybergate | 4cefa282d06c25d74aaf9a1a9fe4c261c1fccc0d91e7322bd12c6a0f15b515c9

General

Target

e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe
Size

1.4MB
MD5

e2f2d1a5670d92c5a4592a519e18f45f
SHA1

7a4fb375b350babcadbcb113953baa0b8f616d52
SHA256

4cefa282d06c25d74aaf9a1a9fe4c261c1fccc0d91e7322bd12c6a0f15b515c9
SHA512

8a9771122affc32648fc50888171f03b37b4e19bef17c56b5077dbf6381d7f19233db30df2aaf1f883ba67eda714067c2a4a3737ea7038c050e1a0fc7943a4e2
SSDEEP

24576:0VuHgWSR0nozWWzxtmS010IWYRhxhC3gaZfvNMVxtUiHPc9FCweEIchwNQCQLFAo:XA1wI/01nDE9vmVciv9wcchwwLFAo

Score

10^/10

cybergate teste1 persistence stealer themida trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

teste1

C2

hackerking.no-ip.org:81

Mutex

HackerKing

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
sefudeu
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{511523IU-F026-5B2G-8NEL-VJ8144O8W3OX}	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{511523IU-F026-5B2G-8NEL-VJ8144O8W3OX}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2216-3-0x0000000000400000-0x00000000006AF000-memory.dmp	themida
behavioral1/memory/2216-7-0x0000000000400000-0x00000000006AF000-memory.dmp	themida
behavioral1/memory/2216-9-0x0000000000400000-0x00000000006AF000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\server.exe	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-6-0x0000000024010000-0x0000000024072000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e2f2d1a5670d92c5a4592a519e18f45f_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-1-0x0000000001FB0000-0x0000000002099000-memory.dmp

Filesize
932KB

Download
memory/2216-0-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2216-2-0x0000000000401000-0x0000000000407000-memory.dmp

Filesize
24KB

Download
memory/2216-3-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2216-7-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download
memory/2216-6-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/2216-9-0x0000000000400000-0x00000000006AF000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads