CyberGate RAT

While tracking this campaign, we found that this malware is served by phishing sites. At the time of our analysis, we found a live phishing site of a cryptocurrency blockchain exchange called Resistance, which is serving the RedLine stealer.

The command-line script present in the ‘RUNPROGRAM’ resource directory to execute embedded files is shown below: cmd /c lsass.com & type ffXi.com >> lsass.com & del ffXi.com & certutil -decode adCt.com R & lsass.com R & ping 127.0.0.1 -n 20

For persistence, it creates an internet shortcut file ‘cghost.url’ in the startup directory with the following contents: [InternetShortcut] URL="%APPDATA%\cghost\dLzSj.vbs"

If it passes all the above checks then it injects the shellcode for the 'RC4' algorithm based on the system architecture into the specified running process or the current process memory.

For persistence, it creates an internet shortcut file ‘cghost.url’ in the startup directory with the following contents: [InternetShortcut] URL="%APPDATA%\cghost\dLzSj.vbs"

The AutoIt script uses custom obfuscation and all the hardcoded strings are encrypted in the malware, as we have seen previously in this campaign.

If it passes all the above checks then it injects the shellcode for the 'RC4' algorithm based on the system architecture into the specified running process or the current process memory.

After that, it decodes the Base64 encoded AutoIt script using ‘certutil’ with the parameter “-decode”, saves it to a file “R”, and then runs this AutoIt script with Autoit3.exe (lsass.com).

The AutoIt script has multiple sandbox evasion tricks to avoid detection. It also checks to see if a file and computer name exists in the system and checks for a particular domain.

Its capabilities range from logging keystrokes to executing commands, stealing credentials, and capturing microphones and webcams.

Its capabilities range from logging keystrokes to executing commands, stealing credentials, and capturing microphones and webcams.

We have found the following commands in this variant of the CyberGate RAT. Commands Descriptions ... dYh3GKy2DK Store data to the registry

MITRE ATT&CK tactic and technique mapping ... T1057 Process Discovery

The capabilities of the CyberGate RAT that we found in this variant include: Collecting the system info

The capabilities of the CyberGate RAT that we found in this variant include: Getting the content of a specified file

The AutoIt script has multiple sandbox evasion tricks to avoid detection. It also checks to see if a file and computer name exists in the system and checks for a particular domain.

MITRE ATT&CK tactic and technique mapping ... T1005 Collect Data from Local System

Its capabilities range from logging keystrokes to executing commands, stealing credentials, and capturing microphones and webcams.

Cybercriminals use this RAT to steal user credentials and spy on victims through screenshots, keyboard logging, and clipboard capturing.

Its capabilities range from logging keystrokes to executing commands, stealing credentials, and capturing microphones and webcams.

The complete traffic is compressed with zlib compression and encrypted with RC4 with the hardcoded key present in the binary.

Adversaries generally use Standard Application Layer Protocols for communication between malware and command and control (C&C) servers... These trends have led some adversaries to turn to custom protocols.

Almost one-third of prevalent malware families we recently analyzed support communication over non-HTTP/S protocols.

The command “Ky8pr22KrbW3” or “neAWM9TC4tsk” creates the specified directory in the %appdata%. It then downloads and stores the specified file inside and executes it.

The complete traffic is compressed with zlib compression and encrypted with RC4 with the hardcoded key present in the binary.

Client and server packets are encrypted or decrypted by RC4 with the same hardcoded key “draZwyK8wNHF”, which is present in the binary.

If it matches the parameters, then it sends the credentials to the server along with the machine info