cybergate | 4e13c2d19af663d2a7e1ee567cc521b07d6444567a825ced1ea85b491cdff029

General

Target

JaffaCakes118_45c3675ed7527d44df67e8ca299efa7c
Size

372KB
Sample

250114-z585jazphz
MD5

45c3675ed7527d44df67e8ca299efa7c
SHA1

bf8b4b60b9d329c27927ed0bb64f8d5cc668a5c4
SHA256

4e13c2d19af663d2a7e1ee567cc521b07d6444567a825ced1ea85b491cdff029
SHA512

04bcc4fd1fb495f79be883d2dbe607eec636491c344f8747789a72a8055a25ab6c40aa843fb4e9922ffe2e8b76f744591f3e6927d95b4d66e08c011e9eb9a64d
SSDEEP

6144:Ef+qqcN6FOrnEudQ9YZ54lAe3g1mip6ypf3F5Z7EuQSbVGEkZ8bAzipaEzw99vYU:5qqcN6FOrDdQ254llwJpd3F5ZpkZ8cOu

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

v1.05.1

Botnet

remote

C2

inarmadax.no-ip.biz:5151

Mutex

E5GJ6B08WG1W6F

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
usbdriver.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
inarmadax

Targets

- Target
  
  JaffaCakes118_45c3675ed7527d44df67e8ca299efa7c
- Size
  
  372KB
- MD5
  
  45c3675ed7527d44df67e8ca299efa7c
- SHA1
  
  bf8b4b60b9d329c27927ed0bb64f8d5cc668a5c4
- SHA256
  
  4e13c2d19af663d2a7e1ee567cc521b07d6444567a825ced1ea85b491cdff029
- SHA512
  
  04bcc4fd1fb495f79be883d2dbe607eec636491c344f8747789a72a8055a25ab6c40aa843fb4e9922ffe2e8b76f744591f3e6927d95b4d66e08c011e9eb9a64d
- SSDEEP
  
  6144:Ef+qqcN6FOrnEudQ9YZ54lAe3g1mip6ypf3F5Z7EuQSbVGEkZ8bAzipaEzw99vYU:5qqcN6FOrDdQ254llwJpd3F5ZpkZ8cOu
Score

10^/10

cybergate remote discovery stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Cybergate family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2