cybergate | a45c2448a9875f61c6f77340c69358a7bb777c7bcd55aa42962ccf294c078488

General

Target

JaffaCakes118_c9cc2f4fd15aedd895a64956462c4724
Size

325KB
Sample

250119-rcz26a1mhn
MD5

c9cc2f4fd15aedd895a64956462c4724
SHA1

cdec2bf4a75fce07d6ebd1eb85bba73e893613e0
SHA256

a45c2448a9875f61c6f77340c69358a7bb777c7bcd55aa42962ccf294c078488
SHA512

f08fbb505000ff71817e48f4ab5ede7e4090b3542640ac2b5d44282d42079acbc3e823af939bc09bb1b0b1d3e0a542ad576d7b080c7970db7dff91ea9d580e1e
SSDEEP

6144:OHU8KBcYBimUsOAfcN9jGqjGSpqrVSx/1gGqgg5HOl0A:OH7a1ifsXfyKyGSp6vBggtA

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

admin

C2

hackerdefrance.no-ip.biz:4666

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
WinUpdate
install_file
WindUpdate.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Net.Framework 3.5 Error
message_box_title
Net.Framework
password
admin
regkey_hkcu
HKCU
regkey_hklm
HKLM

Targets

- Target
  
  JaffaCakes118_c9cc2f4fd15aedd895a64956462c4724
- Size
  
  325KB
- MD5
  
  c9cc2f4fd15aedd895a64956462c4724
- SHA1
  
  cdec2bf4a75fce07d6ebd1eb85bba73e893613e0
- SHA256
  
  a45c2448a9875f61c6f77340c69358a7bb777c7bcd55aa42962ccf294c078488
- SHA512
  
  f08fbb505000ff71817e48f4ab5ede7e4090b3542640ac2b5d44282d42079acbc3e823af939bc09bb1b0b1d3e0a542ad576d7b080c7970db7dff91ea9d580e1e
- SSDEEP
  
  6144:OHU8KBcYBimUsOAfcN9jGqjGSpqrVSx/1gGqgg5HOl0A:OH7a1ifsXfyKyGSp6vBggtA
Score

10^/10

cybergate admin discovery evasion stealer trojan
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Cybergate family

Checks whether UAC is enabled

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2