cybergate | 5a72d96c8acd5242f2488a85010f3fa1ccc27a91c022beb8943ee326f92fedf8 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...45.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_9ca738e90b0d0f035a8bb2dcc9916545
Size

660KB
Sample

250406-z12jws1pw8
MD5

9ca738e90b0d0f035a8bb2dcc9916545
SHA1

1d0924f40b38cb07e9ab280873bb0692f69e0177
SHA256

5a72d96c8acd5242f2488a85010f3fa1ccc27a91c022beb8943ee326f92fedf8
SHA512

5599e539ba6e5d81a595c1275d78f1a20ca8f0888cad8ecc02dc2cbd91e07399153a6f744ba1e17a6869dd8bd544d6604f858c0d9209d39fd3526187ca06aed2
SSDEEP

12288:h+Xgpi9u2rQ4DRMOjVvOkfYmDD+IR/hbhiq73Re+xF00J1Tc4IyC18oYlBcf:h+XD9r/DRvVvOkQmDDlh917UC1cNObcf

Score

10^/10

cybergate remote discovery persistence stealer trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_9ca738e90b0d0f035a8bb2dcc9916545.exe

Resource

win10v2004-20250313-en

cybergate remote discovery persistence stealer trojan upx

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

dominican12345.no-ip.biz:4899

Mutex

677B6U760BUJ17

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123456
regkey_hkcu
HKCU
regkey_hklm
HKLM

Targets

- Target
  
  JaffaCakes118_9ca738e90b0d0f035a8bb2dcc9916545
- Size
  
  660KB
- MD5
  
  9ca738e90b0d0f035a8bb2dcc9916545
- SHA1
  
  1d0924f40b38cb07e9ab280873bb0692f69e0177
- SHA256
  
  5a72d96c8acd5242f2488a85010f3fa1ccc27a91c022beb8943ee326f92fedf8
- SHA512
  
  5599e539ba6e5d81a595c1275d78f1a20ca8f0888cad8ecc02dc2cbd91e07399153a6f744ba1e17a6869dd8bd544d6604f858c0d9209d39fd3526187ca06aed2
- SSDEEP
  
  12288:h+Xgpi9u2rQ4DRMOjVvOkfYmDD+IR/hbhiq73Re+xF00J1Tc4IyC18oYlBcf:h+XD9r/DRvVvOkQmDDlh917UC1cNObcf
Score

10^/10

cybergate remote discovery persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Cybergate family
  cybergate
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cybergateremotediscoverypersistencestealertrojanupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.