MalwareUsed by 1 actor

CyberGate

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TA2541

TA2541 has used process hollowing to execute CyberGate malware.

via mitre attack websiteattack.mitre.org

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.005Visual BasicEvidence1

These emails would appear to contain an attached PDF file that was a link to a .vbs file hosted on Google Drive.

Privilege Escalation

1 technique

T1055.012Process HollowingEvidence1

The sample identified was first seen on Feb. 7, 2013 and was packed with a .NET packer that performs a triple reflection of the RunPE stub, before hollowing a copy of itself to inject the CyberGate malware.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Although always using commodity malware, the acquisition of crypters to wrap the malware makes them more effective.

T1055.012Process HollowingEvidence1

T1620Reflective Code LoadingEvidence1

The sample identified was first seen on Feb. 7, 2013 and was packed with a .NET packer that performs a triple reflection of the RunPE stub

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

The batch file will download and execute another malware, obfuscated with a Delphi packer.

T1219Remote Access ToolsEvidence1

Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC... they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer.

INDICATORS OF COMPROMISE

IOCs tracked for this family

102 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

99 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app9 months ago

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

malwarebytes labsNews

Oct 30, 2023

Remote Access Trojan (RAT) | RAT Malware | RAT Trojans | Malwarebytes Labs

A remote access trojan family noted as having smaller distribution and utilization.

talosintelligence otherNews

Sep 16, 2021

Operation Layover: How we tracked an attack on the aviation industry to five years of compromise

Remote access trojan seen in older linked samples; injected via RunPE/process hollowing and also wrapped with the Aspire crypter in related infrastructure.

mitre attack websiteNews

Jan 18, 2018

Process Injection: Process Hollowing, Sub-technique T1055.012 - Enterprise | MITRE ATT&CK®

Remote access trojan executed via process hollowing by TA2541.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching102

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

CyberGate

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TA2541

TA2541 has used process hollowing to execute CyberGate malware.

via mitre attack websiteattack.mitre.org

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.005Visual BasicEvidence1

These emails would appear to contain an attached PDF file that was a link to a .vbs file hosted on Google Drive.

Privilege Escalation

1 technique

T1055.012Process HollowingEvidence1

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Although always using commodity malware, the acquisition of crypters to wrap the malware makes them more effective.

T1055.012Process HollowingEvidence1

T1620Reflective Code LoadingEvidence1

The sample identified was first seen on Feb. 7, 2013 and was packed with a .NET packer that performs a triple reflection of the RunPE stub

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

The batch file will download and execute another malware, obfuscated with a Delphi packer.

T1219Remote Access ToolsEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

102 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

99 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app9 months ago

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

malwarebytes labsNews

Oct 30, 2023

Remote Access Trojan (RAT) | RAT Malware | RAT Trojans | Malwarebytes Labs

A remote access trojan family noted as having smaller distribution and utilization.

talosintelligence otherNews

Sep 16, 2021

Operation Layover: How we tracked an attack on the aviation industry to five years of compromise

Remote access trojan seen in older linked samples; injected via RunPE/process hollowing and also wrapped with the Aspire crypter in related infrastructure.

mitre attack websiteNews

Jan 18, 2018

Process Injection: Process Hollowing, Sub-technique T1055.012 - Enterprise | MITRE ATT&CK®

Remote access trojan executed via process hollowing by TA2541.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching102

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.