Overview

overview

10

Static

static

3

190e81a9f5...18.exe

windows7-x64

10

190e81a9f5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    190e81a9f5884e7e27e9fbe996566cf9_JaffaCakes118

  • Size

    370KB

  • Sample

    240628-gvsqpaxejn

  • MD5

    190e81a9f5884e7e27e9fbe996566cf9

  • SHA1

    612c2c3cf7faa2508a2dea91071f87bf3fd8ae71

  • SHA256

    a143f63b515f75275b55a2861fa1cfdd1c91f13b7195ab460a84784a8ae512d8

  • SHA512

    969cf9e9c8205850bee1c1e9c67917a8b3c860c5ee9c7fa9a432998402363a041448f33279a8c2fa8a72a21e2978264e8e7802d0b4201889a0f51c5befe145e4

  • SSDEEP

    6144:BSpHIKqV82XrliQsW8ubcadcueLRNI3IGLjsfSYSUi:Pw2lMXVNIXjsfSYg

Score
10/10
cybergateev][lpersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.03.0

Botnet

Ev][L

C2

xgn.r00t.la:5197

ur.now.afraid.org:5197

the.warnet.ignorelist.com:5197
Mutex

LRT5CT7D3QWMKX

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    winsxs

  • install_file

    wdmloader.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    c0tcharm@nte!!

Targets

    • Target

      190e81a9f5884e7e27e9fbe996566cf9_JaffaCakes118

    • Size

      370KB

    • MD5

      190e81a9f5884e7e27e9fbe996566cf9

    • SHA1

      612c2c3cf7faa2508a2dea91071f87bf3fd8ae71

    • SHA256

      a143f63b515f75275b55a2861fa1cfdd1c91f13b7195ab460a84784a8ae512d8

    • SHA512

      969cf9e9c8205850bee1c1e9c67917a8b3c860c5ee9c7fa9a432998402363a041448f33279a8c2fa8a72a21e2978264e8e7802d0b4201889a0f51c5befe145e4

    • SSDEEP

      6144:BSpHIKqV82XrliQsW8ubcadcueLRNI3IGLjsfSYSUi:Pw2lMXVNIXjsfSYg

    Score
    10/10
    cybergateev][lpersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Active Setup

1
T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Active Setup

1
T1547.014

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks