cybergate | f39d93333a104f430af129a4a3249ffba719a526f18f0a70fbe0eb2d40126dc5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
Size

391KB
MD5

20162586a5c51c1863f190e547c07a38
SHA1

62c73ab4c1046153c1a813d9b62984464f5ea689
SHA256

f39d93333a104f430af129a4a3249ffba719a526f18f0a70fbe0eb2d40126dc5
SHA512

8b09b94bae000315109a92af8790b5280d991e04ffff49f7680980b6a43f3df488b7e713fb9fc1a216fcf8c2c103465f9b3caf00cf4e26216ae6bdf2bb8a9f3f
SSDEEP

6144:+/G0N63UDkZLJbOSyLjSzIk8uszQAzrUnYkxezUT9inFj9PShCpDiTxu3g9yLzwt:ax6TJOSyLjSzOusyn3okGFj59gK89vT

Score

10^/10

cybergate remote discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.01.0

Botnet

remote

127.0.0.1:999

Mutex

CyberGate1

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "c:\\directory\\CyberGate\\install\\server.exe Restart"	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2140-0-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral2/memory/2140-3-0x0000000000400000-0x0000000000463000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
2140	JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20162586a5c51c1863f190e547c07a38.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2140-0-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2140-3-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download