cybergate | 99ff78252a2ba0de2095dcb9ef4146ced8aae9c3ca2f5702c73867a72e42332a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4349e9417dfc4ed9a0c1fd0ae8d8f34f.exe
Size

654KB
MD5

4349e9417dfc4ed9a0c1fd0ae8d8f34f
SHA1

d5553e018786e7812cd1da48fdf928d69524e1af
SHA256

99ff78252a2ba0de2095dcb9ef4146ced8aae9c3ca2f5702c73867a72e42332a
SHA512

591c661a615f29c032bd3193d7b47b40f2fce17de1ef3248fe497bfcb75879025d3153ee638c60e5d2de5beb171b8b4204049e7522f70535916aecc5a2663a4c
SSDEEP

12288:3cD6635Q4dLOSwCDfJqlE6uGiGSAlVLuBRzXA2oAMHVB66EYAUTS9D/ksSzQR:3ALtwCc26uGi2VCHXSBzTaDMsAQR

Score

10^/10

cybergate ãéò©discovery stealer trojan

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

ÃÉÒ©

guangkai.gicp.net:1986

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
ÃÉÒ©ºº»¯°æ
message_box_title
·¹¿ÍÍøÂç
password
1986

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2636	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4349e9417dfc4ed9a0c1fd0ae8d8f34f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2672	2636	JaffaCakes118_4349e9417dfc4ed9a0c1fd0ae8d8f34f.exe	30
PID 2636 wrote to memory of 2672	2636	JaffaCakes118_4349e9417dfc4ed9a0c1fd0ae8d8f34f.exe	30
PID 2636 wrote to memory of 2672	2636	JaffaCakes118_4349e9417dfc4ed9a0c1fd0ae8d8f34f.exe	30
PID 2636 wrote to memory of 2672	2636	JaffaCakes118_4349e9417dfc4ed9a0c1fd0ae8d8f34f.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4349e9417dfc4ed9a0c1fd0ae8d8f34f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4349e9417dfc4ed9a0c1fd0ae8d8f34f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 36
  2⤵
  - Program crash
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-0-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download