General

  • Target

    JaffaCakes118_0bb216970c4628d76797ec5ee99c74a4

  • Size

    494KB

  • Sample

    250220-n5s8javlam

  • MD5

    0bb216970c4628d76797ec5ee99c74a4

  • SHA1

    3de5cb02470a9c5f1ab97436017e4b886d4ebe3e

  • SHA256

    a72c4e2df9ad2ab4cd98036800db91024fad81ac30e36962787b4cd085076a8a

  • SHA512

    1d41ff9309db944eac354d39910fdd30493fdb42d332459f87f5b16f192ac04f400750462767668ebdcbc6b13671b70dd3eed9cca802cf2c45bb4d09451c613e

  • SSDEEP

    12288:oVjR0gatIW9piUmth6HjMsl7HIzfJxGzLZrm6O+:o1R0gaOAStYdVIzfJxKZrC+

Malware Config

Extracted

Family

cybergate

Version

v1.02.0

Botnet

remote

C2

powerston.no-ip.org:239

Mutex

CyberGate1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    2391986

Targets

    • Target

      JaffaCakes118_0bb216970c4628d76797ec5ee99c74a4

    • Size

      494KB

    • MD5

      0bb216970c4628d76797ec5ee99c74a4

    • SHA1

      3de5cb02470a9c5f1ab97436017e4b886d4ebe3e

    • SHA256

      a72c4e2df9ad2ab4cd98036800db91024fad81ac30e36962787b4cd085076a8a

    • SHA512

      1d41ff9309db944eac354d39910fdd30493fdb42d332459f87f5b16f192ac04f400750462767668ebdcbc6b13671b70dd3eed9cca802cf2c45bb4d09451c613e

    • SSDEEP

      12288:oVjR0gatIW9piUmth6HjMsl7HIzfJxGzLZrm6O+:o1R0gaOAStYdVIzfJxKZrC+

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Cybergate family

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks