cybergate | a2a55408e4326723ecbfedb711ef8f742e9260f7d426cd02b368913388853b8e

General

Target

1aca1f20194a95a633ee4c425f08ecd8_JaffaCakes118
Size

349KB
Sample

240701-lkmh5sxdpn
MD5

1aca1f20194a95a633ee4c425f08ecd8
SHA1

f74ba37a419dbb62fd16f7a8984a202be22a9b94
SHA256

a2a55408e4326723ecbfedb711ef8f742e9260f7d426cd02b368913388853b8e
SHA512

c35c40bef68603b4f6ddd3911af793bdc026ecd39ea0119c92e1c45eb3a6d18a3a14ac220b6751f3bf6ff58a6e4cdddef6d0243c831e9c2b0eb7b2f0d262b876
SSDEEP

6144:X000ch20uz9pyqPFWxNKKaHN9/01yHPZOhcrG0gNVBbuHbRKCVq5oNabO:XphE7Wxar8yoiDgNnMHqGEO

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

Botishe

C2

botishe.no-ip.org:8080

botishe.no-ip.org:81

botishe.no-ip.org:8000

botishe.no-ip.org:110

botishe.no-ip.org:3128

botishe.no-ip.org:21

botishe.no-ip.org:25

botishe.no-ip.org:432

botishe.no-ip.org:65000

botishe.no-ip.org:53001

botishe.no-ip.org:9989

botishe.no-ip.org:6939

botishe.no-ip.org:5742

botishe.no-ip.org:3389

botishe.no-ip.org:8888

botishe.no-ip.org:7777

Mutex

4HO5F1CS08WLJ3

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
winlogon.exe
install_dir
win32
install_file
explorer.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
12RT3456Z
regkey_hkcu
winlogon
regkey_hklm
winlogon

Targets

- Target
  
  1aca1f20194a95a633ee4c425f08ecd8_JaffaCakes118
- Size
  
  349KB
- MD5
  
  1aca1f20194a95a633ee4c425f08ecd8
- SHA1
  
  f74ba37a419dbb62fd16f7a8984a202be22a9b94
- SHA256
  
  a2a55408e4326723ecbfedb711ef8f742e9260f7d426cd02b368913388853b8e
- SHA512
  
  c35c40bef68603b4f6ddd3911af793bdc026ecd39ea0119c92e1c45eb3a6d18a3a14ac220b6751f3bf6ff58a6e4cdddef6d0243c831e9c2b0eb7b2f0d262b876
- SSDEEP
  
  6144:X000ch20uz9pyqPFWxNKKaHN9/01yHPZOhcrG0gNVBbuHbRKCVq5oNabO:XphE7Wxar8yoiDgNnMHqGEO
Score

10^/10

cybergate botishe persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2