cybergate | 0706f57e636e59696e5b66ed84847546f553b3b75ec4377a653be9eeffadffe6

General

Target

1fbbedda31426d31d650b6d068ec0b87_JaffaCakes118
Size

458KB
Sample

240702-scrapaxfrb
MD5

1fbbedda31426d31d650b6d068ec0b87
SHA1

5f5d0c88bc5f5599ec6084ff30a5385e0c914f69
SHA256

0706f57e636e59696e5b66ed84847546f553b3b75ec4377a653be9eeffadffe6
SHA512

ad9b011abc66472c48575e78ff031ff06e44e975257cd7b694377f63a0a34ba7cf7d614875bfced026a1965b32027ba94862e310329bf52826f16ded8aa14212
SSDEEP

12288:DW1K3DnsavJFpq4fv2wFt1IyzjZwC8yUeM:DW4DsKkO2wFtyWjZwC8NeM

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

sakaryalionur.zapto.org:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
svchost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Extracted

Family

latentbot

C2

sakaryalionur.zapto.org

Targets

- Target
  
  1fbbedda31426d31d650b6d068ec0b87_JaffaCakes118
- Size
  
  458KB
- MD5
  
  1fbbedda31426d31d650b6d068ec0b87
- SHA1
  
  5f5d0c88bc5f5599ec6084ff30a5385e0c914f69
- SHA256
  
  0706f57e636e59696e5b66ed84847546f553b3b75ec4377a653be9eeffadffe6
- SHA512
  
  ad9b011abc66472c48575e78ff031ff06e44e975257cd7b694377f63a0a34ba7cf7d614875bfced026a1965b32027ba94862e310329bf52826f16ded8aa14212
- SSDEEP
  
  12288:DW1K3DnsavJFpq4fv2wFt1IyzjZwC8yUeM:DW4DsKkO2wFtyWjZwC8NeM
Score

10^/10

cybergate latentbot vítima bootkit persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- LatentBot
  Modular trojan written in Delphi which has been in-the-wild since 2013.
  trojan latentbot
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

CyberGate, Rebhip

LatentBot

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Deletes itself

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Drops desktop.ini file(s)

Writes to the Master Boot Record (MBR)

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2