cybergate | 350c88a68b93d7d145373ee633a7b8896358eb4afc03b2bc0d05f1e71566dd8a

General

Target

JaffaCakes118_1fca4e3fb4fabe3a7f6c48c9dec2e739
Size

801KB
Sample

250223-kt9jla1pan
MD5

1fca4e3fb4fabe3a7f6c48c9dec2e739
SHA1

fe0d0fc95d770d2621a5faeae4f99f487657e92a
SHA256

350c88a68b93d7d145373ee633a7b8896358eb4afc03b2bc0d05f1e71566dd8a
SHA512

4a2a7b9d2ebeb292765461ca811d6b354300e68cc7f7e4b6c9622963b5e9259e60e330589bbf20b293bcbf829c4cab40dc62fd566f12e9e644c3a43cd530f83f
SSDEEP

12288:Kcb0rdyVYhUjdI/HEEi6E+2LguIEarpTrW6YWuBAykXUD7bVB4b7G1uC0nRgEJf8:jIZ/PtxNhhf+epl

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

127.0.0.1:1111

Mutex

P1L5C4UYIRH68Y

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
maniac

Targets

- Target
  
  JaffaCakes118_1fca4e3fb4fabe3a7f6c48c9dec2e739
- Size
  
  801KB
- MD5
  
  1fca4e3fb4fabe3a7f6c48c9dec2e739
- SHA1
  
  fe0d0fc95d770d2621a5faeae4f99f487657e92a
- SHA256
  
  350c88a68b93d7d145373ee633a7b8896358eb4afc03b2bc0d05f1e71566dd8a
- SHA512
  
  4a2a7b9d2ebeb292765461ca811d6b354300e68cc7f7e4b6c9622963b5e9259e60e330589bbf20b293bcbf829c4cab40dc62fd566f12e9e644c3a43cd530f83f
- SSDEEP
  
  12288:Kcb0rdyVYhUjdI/HEEi6E+2LguIEarpTrW6YWuBAykXUD7bVB4b7G1uC0nRgEJf8:jIZ/PtxNhhf+epl
Score

10^/10

cybergate remote discovery stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Cybergate family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2