cybergate | 1a269eb878940b81da61fb53ef6f7d1a373706dff2302a1ebdc459c401962705

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2025 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c9b2218ce3032824ffb28628f11bf694.exe
Size

456KB
MD5

c9b2218ce3032824ffb28628f11bf694
SHA1

accff741acf87f47221077ec87090801ea50a420
SHA256

1a269eb878940b81da61fb53ef6f7d1a373706dff2302a1ebdc459c401962705
SHA512

ed328715956d36455eb0bdfaa06b65fbc3029c6248cc29ee79c7e5f38ddb81b69dd530d938745755f19073290746fc57ebab7486656371bae0df2bc83667851c
SSDEEP

12288:BnpH4HYWO9LZ2zkPaCxfcHDG627k5jE0HvYLQwi:5pHfLZOkleHDG1Wj2Qwi

Score

10^/10

cybergate vítima discovery stealer trojan

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

127.0.0.1:999

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Molebox Virtualization software 1 IoCs

Detects file using Molebox Virtualization software.

resource	yara_rule
behavioral2/memory/3672-3-0x0000000000400000-0x000000000049D000-memory.dmp	molebox

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3444	3672	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c9b2218ce3032824ffb28628f11bf694.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c9b2218ce3032824ffb28628f11bf694.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c9b2218ce3032824ffb28628f11bf694.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 512
  2⤵
  - Program crash
  PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 3672
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3672-0-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/3672-1-0x0000000000770000-0x00000000007AD000-memory.dmp

Filesize
244KB

Download
memory/3672-2-0x0000000002560000-0x0000000002570000-memory.dmp

Filesize
64KB

Download
memory/3672-7-0x0000000076FE0000-0x0000000076FE1000-memory.dmp

Filesize
4KB

Download
memory/3672-9-0x0000000076FC0000-0x00000000770B0000-memory.dmp

Filesize
960KB

Download
memory/3672-8-0x0000000076FC0000-0x00000000770B0000-memory.dmp

Filesize
960KB

Download
memory/3672-4-0x0000000077872000-0x0000000077873000-memory.dmp

Filesize
4KB

Download
memory/3672-3-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3672-6-0x0000000002360000-0x0000000002370000-memory.dmp

Filesize
64KB

Download
memory/3672-5-0x0000000002230000-0x0000000002240000-memory.dmp

Filesize
64KB

Download
memory/3672-10-0x0000000076FC0000-0x00000000770B0000-memory.dmp

Filesize
960KB

Download
memory/3672-11-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3672-12-0x0000000000770000-0x00000000007AD000-memory.dmp

Filesize
244KB

Download
memory/3672-13-0x0000000076FC0000-0x00000000770B0000-memory.dmp

Filesize
960KB

Download