cybergate | d2d8de76a7e9b1e97afaef0a661b5604846d65c19b6a4034f80d3efdd7ff4255

General

Target

JaffaCakes118_3b40cdfd5e5d260786755fd8368e1b0d
Size

67KB
Sample

250127-c3erksxmel
MD5

3b40cdfd5e5d260786755fd8368e1b0d
SHA1

45ca7652ad1cb70e65135f5ddd9019f8c4b6d22f
SHA256

d2d8de76a7e9b1e97afaef0a661b5604846d65c19b6a4034f80d3efdd7ff4255
SHA512

ca9640a5407738c8f9018feaf2d6e9da2b142d9cd2659ba8ec1b6f941478dd9b4daf814dffe0bd974cd5d198e48a7cb5795ca4a4da5a6725b5fc40e3fe3253b1
SSDEEP

1536:GexCEtlBXQKRP3fZVxodVVbfhWxyYkyrO88oPYQrH:vltlhRffZVxodnEzLOiPj

Score

10^/10

Malware Config

Extracted

Family

cybergate

Botnet

FALSE

C2

ÝØðÕÞÎÝÎÅý¼¼ûÙÈìÎÓßýØØÎÙÏÏ¼¼êÕÎÈÉÝÐìÎÓÈÙßÈ¼¼êÕÎÈÉÝÐýÐÐÓß¼¼êÕÎÈÉÝÐúÎÙÙ¼¼¼ùÄÕÈìÎÓßÙÏÏ¼¼¼ðÏÝÿÐÓÏÙ¼¼ÿÎÅÌÈéÒÌÎÓÈÙßÈøÝÈÝ¼¼óÐÙõÒÕÈÕÝÐÕÆÙ¼¼¼ïÅÏúÎÙÙïÈÎÕÒÛ¼¼¼ìïÈÓÎÙÿÎÙÝÈÙõÒÏÈÝÒßÙ¼¼îÝÏùÒÉÑùÒÈÎÕÙÏý¼¼¼ïôûÙÈïÌÙßÕÝÐúÓÐØÙÎìÝÈÔý¼¼¼ÿÔÝÎòÙÄÈý¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼500}

process

FALSE

16

0

título da mensagem

texto da mensagem

TRUE

[email protected]

smtp.mail.yahoo.com.br

ª÷Öº+Þ

587

30

Mutex

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
FALSE
install_dir
TRUE
install_file
TRUE
install_flag
true
keylogger_enable_ftp
false
message_box_caption
TRUE
message_box_title
TRUE
password
FALSE
regkey_hkcu
TRUE
regkey_hklm
TRUE

Extracted

Family

cybergate

Version

2.0.6

Botnet

Cliente

C2

spyhacking.no-ip.org:5150

Mutex

system

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
[email protected]
ftp_interval
30
injected_process
process.exe
install_dir
install
install_file
system.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abc1234
regkey_hkcu
process
regkey_hklm
process

Targets

- Target
  
  JaffaCakes118_3b40cdfd5e5d260786755fd8368e1b0d
- Size
  
  67KB
- MD5
  
  3b40cdfd5e5d260786755fd8368e1b0d
- SHA1
  
  45ca7652ad1cb70e65135f5ddd9019f8c4b6d22f
- SHA256
  
  d2d8de76a7e9b1e97afaef0a661b5604846d65c19b6a4034f80d3efdd7ff4255
- SHA512
  
  ca9640a5407738c8f9018feaf2d6e9da2b142d9cd2659ba8ec1b6f941478dd9b4daf814dffe0bd974cd5d198e48a7cb5795ca4a4da5a6725b5fc40e3fe3253b1
- SSDEEP
  
  1536:GexCEtlBXQKRP3fZVxodVVbfhWxyYkyrO88oPYQrH:vltlhRffZVxodnEzLOiPj
Score

10^/10

cybergate cliente discovery persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2