Overview

overview

10

Static

static

926c51ff26...bf.exe

windows7-x64

10

926c51ff26...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    926c51ff26dcad0f4e61cc66c7df26f130b6ec6351a7f548fbc90e7c82b188bf

  • Size

    464KB

  • Sample

    220919-b532hsbbe2

  • MD5

    ed11e8aa6dfc108eab3560d20a90047c

  • SHA1

    65e31696064fcf49207d22142f8166ee7e3294c7

  • SHA256

    926c51ff26dcad0f4e61cc66c7df26f130b6ec6351a7f548fbc90e7c82b188bf

  • SHA512

    f214e6bf38239ac394e94834cf5742223c2b76315c0be4ea9aa69a8985f0ae2a3ddef38f093258f6df622c0312dfb6f860e5b494aca5b0af9fd085b9d9dfe81c

  • SSDEEP

    12288:AP7ZyPBOzdvKZivg/egCFs2jrUDsyCgLsaeO:AzZyPQzdvJvceVwsyNsa

Score
10/10
cybergatewalllero sxe 11.6persistencestealertrojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

WALLLERO SXE 11.6

C2

braian.no-ip.biz:4662

Mutex

1MABO4436T64FQ

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Win32

  • install_file

    Win32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    Win32

  • regkey_hklm

    Win32

Targets

    • Target

      926c51ff26dcad0f4e61cc66c7df26f130b6ec6351a7f548fbc90e7c82b188bf

    • Size

      464KB

    • MD5

      ed11e8aa6dfc108eab3560d20a90047c

    • SHA1

      65e31696064fcf49207d22142f8166ee7e3294c7

    • SHA256

      926c51ff26dcad0f4e61cc66c7df26f130b6ec6351a7f548fbc90e7c82b188bf

    • SHA512

      f214e6bf38239ac394e94834cf5742223c2b76315c0be4ea9aa69a8985f0ae2a3ddef38f093258f6df622c0312dfb6f860e5b494aca5b0af9fd085b9d9dfe81c

    • SSDEEP

      12288:AP7ZyPBOzdvKZivg/egCFs2jrUDsyCgLsaeO:AzZyPQzdvJvceVwsyNsa

    Score
    10/10
    cybergatewalllero sxe 11.6persistencestealertrojan

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks