cybergate | 3382ffb047e0f8a467bbb693099388cca8b820bc9a7fd4a86532b828ace49873

General

Target

JaffaCakes118_16557e919ef3fd8fe881db739396d75f
Size

312KB
Sample

250123-mmglcawpes
MD5

16557e919ef3fd8fe881db739396d75f
SHA1

59ac9438d45bbd247993668089e6fbcc58be367c
SHA256

3382ffb047e0f8a467bbb693099388cca8b820bc9a7fd4a86532b828ace49873
SHA512

17f025b43765be26662ce274b9e07f943a492041caf536b4ef6dfe2b7b285a795c66b7197cf7656a2712c22a9de30537aea14f4e6454e380d28aeace04e1754c
SSDEEP

6144:shpBWppyrxtVnax8hGag2C3N0iyjjo7uva13//UDJoOtTVNrYIw:aappu9ax8HBC3e2uiV/e5w

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

runaway2.no-ip.biz:6643

Mutex

4N86BK5B6I25B8

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
goodone

Targets

- Target
  
  JaffaCakes118_16557e919ef3fd8fe881db739396d75f
- Size
  
  312KB
- MD5
  
  16557e919ef3fd8fe881db739396d75f
- SHA1
  
  59ac9438d45bbd247993668089e6fbcc58be367c
- SHA256
  
  3382ffb047e0f8a467bbb693099388cca8b820bc9a7fd4a86532b828ace49873
- SHA512
  
  17f025b43765be26662ce274b9e07f943a492041caf536b4ef6dfe2b7b285a795c66b7197cf7656a2712c22a9de30537aea14f4e6454e380d28aeace04e1754c
- SSDEEP
  
  6144:shpBWppyrxtVnax8hGag2C3N0iyjjo7uva13//UDJoOtTVNrYIw:aappu9ax8HBC3e2uiV/e5w
Score

10^/10

cybergate remote discovery stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Cybergate family

Checks computer location settings

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2