Overview

overview

10

Static

static

3

e991fb7f25...18.exe

windows7-x64

10

e991fb7f25...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e991fb7f256d7362790e8cfca9ad73de_JaffaCakes118

  • Size

    458KB

  • Sample

    241213-dgzqaswpg1

  • MD5

    e991fb7f256d7362790e8cfca9ad73de

  • SHA1

    466031e288efac1c286d0414f6baafa422e42417

  • SHA256

    abb7381edff3b0e6e2701f968c142f61e8fa5647bd574a6781baad48058a0c0c

  • SHA512

    7f1530d61094c4cddb03f857de787e98a7ce9bf9e2fa8c679abcef22578ccbabe535b0f0379e5b67d0026f7bfa425efe2fe2ef63c17b92e006c562eea3eb580f

  • SSDEEP

    12288:dCNI2RYTxW/4lrsPqFYS41umIMJcEG1+Ank:UNI2R40/4VbLmJcEGMik

Score
10/10
cybergatebl4d3_2011discoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

bl4d3_2011

C2

bl4d3.zapto.org:82

Mutex

OQ46BHF00746FV

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    tox1c

Targets

    • Target

      e991fb7f256d7362790e8cfca9ad73de_JaffaCakes118

    • Size

      458KB

    • MD5

      e991fb7f256d7362790e8cfca9ad73de

    • SHA1

      466031e288efac1c286d0414f6baafa422e42417

    • SHA256

      abb7381edff3b0e6e2701f968c142f61e8fa5647bd574a6781baad48058a0c0c

    • SHA512

      7f1530d61094c4cddb03f857de787e98a7ce9bf9e2fa8c679abcef22578ccbabe535b0f0379e5b67d0026f7bfa425efe2fe2ef63c17b92e006c562eea3eb580f

    • SSDEEP

      12288:dCNI2RYTxW/4lrsPqFYS41umIMJcEG1+Ank:UNI2R40/4VbLmJcEGMik

    Score
    10/10
    cybergatebl4d3_2011discoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks