cybergate | 8d93ec7a09dea50582402fd305aa546fd00dea9f98af708fdbe0e604fc5be174

Sharing

Copy URL

Twitter E-mail

General

Target

1d2449362a4ec59eec58f4b4af2086b0_JaffaCakes118
Size

1.3MB
Sample

240702-a2xvnatcmq
MD5

1d2449362a4ec59eec58f4b4af2086b0
SHA1

73d502e981e057db291a986bb7231c1a1b40c2be
SHA256

8d93ec7a09dea50582402fd305aa546fd00dea9f98af708fdbe0e604fc5be174
SHA512

fc5d7f97ac7ccf5f3d0e82b0670a108edd0f0d4f85f732f19b421cbc7ed659d37bc68d697228e84fb0b7904d46b7c9391f012c017cc1ab7cec8a022207bd049a
SSDEEP

24576:YKwQrsiK3Sr0ckHCb2vjNDqKZb1lxJKjNDqKZb1lxJp:YKl83VckHtjsIzrKjsIzrp

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

10.0.2.15

10.0.2.15:80

Mutex

crack

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
espiao.exe
install_dir
spynet
install_file
spy.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Ja entrou!
message_box_title
Ups
password
md
regkey_hkcu
HKCU
regkey_hklm
HKLM

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  1d2449362a4ec59eec58f4b4af2086b0_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  1d2449362a4ec59eec58f4b4af2086b0
- SHA1
  
  73d502e981e057db291a986bb7231c1a1b40c2be
- SHA256
  
  8d93ec7a09dea50582402fd305aa546fd00dea9f98af708fdbe0e604fc5be174
- SHA512
  
  fc5d7f97ac7ccf5f3d0e82b0670a108edd0f0d4f85f732f19b421cbc7ed659d37bc68d697228e84fb0b7904d46b7c9391f012c017cc1ab7cec8a022207bd049a
- SSDEEP
  
  24576:YKwQrsiK3Sr0ckHCb2vjNDqKZb1lxJKjNDqKZb1lxJp:YKl83VckHtjsIzrKjsIzrp
Score

10^/10

cybergate sality 10.0.2.15 backdoor evasion persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2