cybergate | 2acb8795c2da3c0b117cc30bf9d12156464371abad53bb486f858c1dc74d7975

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2025, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
Size

289KB
MD5

6f7805f24b63fbec84b83dfc3b1190c8
SHA1

49d35e7ab1c5eb0ed714c0b0421054dce333ab2c
SHA256

2acb8795c2da3c0b117cc30bf9d12156464371abad53bb486f858c1dc74d7975
SHA512

fbd8e1c95c42bdf9da126fa4489c085006540f915d66ca57189649a658c69cf6b9b233e93aa1cb6374949ff81e3d19f80162064f5fa0638abb14638baaa7b099
SSDEEP

6144:D/G0N63UDkF+88uszQAzrUnYkxe81AN9PShCpD6vvBnB1Hxbt:Dx6Kusyn3oeAN5CvBTHH

Score

10^/10

cybergate remote discovery persistence stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.00.1

Botnet

remote

127.0.0.1:999

Mutex

CyberGate1

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "c:\\directory\\CyberGate\\install\\server.exe Restart"	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
1612	JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f7805f24b63fbec84b83dfc3b1190c8.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1612