cybergate | fecbecbef28ebca00338de6dbde3628d925bf181c31786fcc720e180281e26ec

General

Target

184b706cbc8bddea9ab827ef2f73a77d_JaffaCakes118
Size

331KB
Sample

240628-bwc4qstdnb
MD5

184b706cbc8bddea9ab827ef2f73a77d
SHA1

45c3a0276e5eb780ff0426fdfc64abe131cad1dc
SHA256

fecbecbef28ebca00338de6dbde3628d925bf181c31786fcc720e180281e26ec
SHA512

bf234dcaf9a3837b83decd9540f9fbb42bc247204f4f28b932b6a507a48cf33bb54be5ee6ffe0da2a52b4c4ec573792e2009e9de06fba4e53996c7ca8b57a0f5
SSDEEP

6144:alL7k3mcD66RRjo5JGmrpQsK3RD2u270jupCJsCxC:OLoWcD663VZ2zkPaCx

Score

10^/10

Malware Config

Targets

- Target
  
  184b706cbc8bddea9ab827ef2f73a77d_JaffaCakes118
- Size
  
  331KB
- MD5
  
  184b706cbc8bddea9ab827ef2f73a77d
- SHA1
  
  45c3a0276e5eb780ff0426fdfc64abe131cad1dc
- SHA256
  
  fecbecbef28ebca00338de6dbde3628d925bf181c31786fcc720e180281e26ec
- SHA512
  
  bf234dcaf9a3837b83decd9540f9fbb42bc247204f4f28b932b6a507a48cf33bb54be5ee6ffe0da2a52b4c4ec573792e2009e9de06fba4e53996c7ca8b57a0f5
- SSDEEP
  
  6144:alL7k3mcD66RRjo5JGmrpQsK3RD2u270jupCJsCxC:OLoWcD663VZ2zkPaCx
Score

10^/10

cybergate evasion persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

UPX packed file

Adds Run key to start application

Maps connected drives based on registry

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2