cybergate | 26e668f92f47b23d7f77e16d003ea0b85f4109a6e2f92fe8632193ffc653c79f

General

Target

JaffaCakes118_65585b3cbc3e588b3794150a57767294
Size

744KB
Sample

250116-abftfsslbm
MD5

65585b3cbc3e588b3794150a57767294
SHA1

7f59d6d992f03035725f16d19425a9424ae5079a
SHA256

26e668f92f47b23d7f77e16d003ea0b85f4109a6e2f92fe8632193ffc653c79f
SHA512

0f166e61edf739d7048415b45d3b0446f5e8ea25526b455ad60e39c232717c319b2e037d039194e303f3426636e6f1a07bf3c49b7fc63bb274f9aee6bcd55abe
SSDEEP

12288:/DZBEY0ZkzezocSgYiQ7BC1QnVW6v0FpfTd7qm66mD7rmXf2g5XsTrSbTdoi3d:w5zLadT6Mmv3ik

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

127.0.0.1:288

Mutex

***MUTEX***

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_file
windows.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
t?tulo da mensagem
password
abcd1234

Targets

- Target
  
  JaffaCakes118_65585b3cbc3e588b3794150a57767294
- Size
  
  744KB
- MD5
  
  65585b3cbc3e588b3794150a57767294
- SHA1
  
  7f59d6d992f03035725f16d19425a9424ae5079a
- SHA256
  
  26e668f92f47b23d7f77e16d003ea0b85f4109a6e2f92fe8632193ffc653c79f
- SHA512
  
  0f166e61edf739d7048415b45d3b0446f5e8ea25526b455ad60e39c232717c319b2e037d039194e303f3426636e6f1a07bf3c49b7fc63bb274f9aee6bcd55abe
- SSDEEP
  
  12288:/DZBEY0ZkzezocSgYiQ7BC1QnVW6v0FpfTd7qm66mD7rmXf2g5XsTrSbTdoi3d:w5zLadT6Mmv3ik
Score

10^/10

cybergate öííé discovery stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Cybergate family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2