cybergate | 8ce369852289408b56f378c9cae7b9b037b984d95384e2916abe8c0c3bac2485

General

Target

JaffaCakes118_6a752d2cdf69242d1790769c0ab3825e
Size

429KB
Sample

250312-mdsbgsxvax
MD5

6a752d2cdf69242d1790769c0ab3825e
SHA1

9e2afaa4cd7911e4074a85c0e6cb0f78992e9e36
SHA256

8ce369852289408b56f378c9cae7b9b037b984d95384e2916abe8c0c3bac2485
SHA512

f186e8e7d24e55da3e42b90a1c60b064b93a5a9f937bde20aa10e47fbd647251c3f70b3ff9bf3fda9d5f27f8c62760fb038b45c39cbbf8bc138663739456fcd9
SSDEEP

12288:NsWFjDSGH/RQ1ula2tNMhhlnpBTvIjVGGk2:GWj1/zcUNMh1Fvap

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

v1.01.3

Botnet

remote

C2

gonza09.no-ip.org:81

Mutex

Msn

Attributes

enable_keylogger
false
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
Messenger Discovey
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
Messenger discovey
password
gonzalo

Targets

- Target
  
  JaffaCakes118_6a752d2cdf69242d1790769c0ab3825e
- Size
  
  429KB
- MD5
  
  6a752d2cdf69242d1790769c0ab3825e
- SHA1
  
  9e2afaa4cd7911e4074a85c0e6cb0f78992e9e36
- SHA256
  
  8ce369852289408b56f378c9cae7b9b037b984d95384e2916abe8c0c3bac2485
- SHA512
  
  f186e8e7d24e55da3e42b90a1c60b064b93a5a9f937bde20aa10e47fbd647251c3f70b3ff9bf3fda9d5f27f8c62760fb038b45c39cbbf8bc138663739456fcd9
- SSDEEP
  
  12288:NsWFjDSGH/RQ1ula2tNMhhlnpBTvIjVGGk2:GWj1/zcUNMh1Fvap
Score

10^/10

cybergate remote discovery stealer trojan upx vmprotect
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Cybergate family

VMProtect packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2