cybergate | 1a77003985c5ebb5d099048dbb2f3dfbc235dda394e8ae335cce65bf2e2fb8c1 | Triage

Submit
Reports

Overview

overview

Static

static

7

f082e01d94...18.exe

windows7-x64

f082e01d94...18.exe

windows10-2004-x64

3

Sharing

General

Target

f082e01d9458fc0c6141ac67ff1f8e98_JaffaCakes118
Size

1.9MB
Sample

241214-y2n5hssqhw
MD5

f082e01d9458fc0c6141ac67ff1f8e98
SHA1

b029609b1bcc173166015efab3256d4f447e5f8d
SHA256

1a77003985c5ebb5d099048dbb2f3dfbc235dda394e8ae335cce65bf2e2fb8c1
SHA512

428a98832e9e17f13731ed88fb03e175bce894acc679637daecb6a99df6c5903cc8cb13bd863d0148b6186987184999eeffc8b4fd423caf3d11396bceb3b0862
SSDEEP

49152:NYxTVz0eC4wubN8hbXJjaK34eJMVfJMV:MVzv67f34KMbM

Score

10^/10

cybergate discovery persistence stealer themida trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

f082e01d9458fc0c6141ac67ff1f8e98_JaffaCakes118.exe

Resource

win7-20240903-en

cybergate discovery persistence stealer themida trojan upx

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

f082e01d9458fc0c6141ac67ff1f8e98_JaffaCakes118.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  f082e01d9458fc0c6141ac67ff1f8e98_JaffaCakes118
- Size
  
  1.9MB
- MD5
  
  f082e01d9458fc0c6141ac67ff1f8e98
- SHA1
  
  b029609b1bcc173166015efab3256d4f447e5f8d
- SHA256
  
  1a77003985c5ebb5d099048dbb2f3dfbc235dda394e8ae335cce65bf2e2fb8c1
- SHA512
  
  428a98832e9e17f13731ed88fb03e175bce894acc679637daecb6a99df6c5903cc8cb13bd863d0148b6186987184999eeffc8b4fd423caf3d11396bceb3b0862
- SSDEEP
  
  49152:NYxTVz0eC4wubN8hbXJjaK34eJMVfJMV:MVzv67f34KMbM
Score

10^/10

cybergate discovery persistence stealer themida trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cybergatediscoverypersistencestealerthemidatrojanupx

behavioral2

© 2018-2025

Terms | Privacy