cybergate | 276691a16fe41df718f09b69876e4f525a68200dd5b282733f3b8be2db1bfadf

General

Target

JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe
Size

202KB
MD5

7c3eb2e69062fb9b20c25df818ed6f00
SHA1

1021d120b28f99b90af504c93926dde48804a8fb
SHA256

276691a16fe41df718f09b69876e4f525a68200dd5b282733f3b8be2db1bfadf
SHA512

737ad272d62b5c1a1ebf94830780a03d11e8177d8a6556a61e1c8f9100dfdcd1424aba308e2f04d8cf53eb0c492ecccd7270e1700a6ac332a154ab76ba1d5e6e
SSDEEP

3072:IopGtIX+LOWtxaD271t2KVco5mFXWvTnHrW1oUCDjmFvlk1wZChDNY:pXqdtxaD271tfVV5mFIe1ojq6qWNY

Score

10^/10

cybergate cracker discovery stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cracker

C2

192168.no-ip.org:88

crackerfull.no-ip.org:87

crackerfull.no-ip.org:88

Mutex

2R7O2P55S36KO7

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_file
csrss.dll
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	1904	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 2532 wrote to memory of 1904	2532	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	30
PID 1904 wrote to memory of 2324	1904	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	31
PID 1904 wrote to memory of 2324	1904	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	31
PID 1904 wrote to memory of 2324	1904	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	31
PID 1904 wrote to memory of 2324	1904	JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 192
    3⤵
    - Program crash
    PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-8-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-10-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-15-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-14-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1904-11-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-9-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-17-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-16-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1904-18-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing