cybergate | 6980711b3597ce3b2e517e51aad3b40b7ba8074df509a8e246b30506e2e81985

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
15-01-2025 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_58bf36a159526791715ed7264b7ed8d2.exe
Size

370KB
MD5

58bf36a159526791715ed7264b7ed8d2
SHA1

947da66ce8671483181acbe8ea5b5947f29f47da
SHA256

6980711b3597ce3b2e517e51aad3b40b7ba8074df509a8e246b30506e2e81985
SHA512

6b1b3f99da52580f6e883f0630926d11fee053edc14542db746e0c9b101f8415b65e84f4897836afac73017de056e00a0a19db3c8a25f0e702ca15ccedee6821
SSDEEP

6144:rOpslERlqoQMPEwvdhdBCkWSzyEE81pjSKoW78U1bgibiDNX4:rwsl7wvdTBJeH87GAf11beNX

Score

10^/10

cybergate remote discovery stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.0

Botnet

remote

mydanter.zapto.org:60123

mydanter.zapto.org:1900

mydanter.dyndns-work.com:137

mydanter.dyndns-work.com:5939

mydanter.dyndns-work.com:12345

mydanter.no-ip.org:60125

Mutex

L0V0ON77B2T254

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_file
jusched.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Error on Line 217. Unknown variable!
message_box_title
ERROR
password
12345
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	1384	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_58bf36a159526791715ed7264b7ed8d2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1996	1384	JaffaCakes118_58bf36a159526791715ed7264b7ed8d2.exe	31
PID 1384 wrote to memory of 1996	1384	JaffaCakes118_58bf36a159526791715ed7264b7ed8d2.exe	31
PID 1384 wrote to memory of 1996	1384	JaffaCakes118_58bf36a159526791715ed7264b7ed8d2.exe	31
PID 1384 wrote to memory of 1996	1384	JaffaCakes118_58bf36a159526791715ed7264b7ed8d2.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58bf36a159526791715ed7264b7ed8d2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58bf36a159526791715ed7264b7ed8d2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 192
  2⤵
  - Program crash
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1384-1-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download