cybergate | 9a7a17645ae103f2b14917e1a71c56b6ae13c81ca09522ead4423358f9064725

General

Target

9a7a17645ae103f2b14917e1a71c56b6ae13c81ca09522ead4423358f9064725
Size

492KB
Sample

220919-dkq8bsdeh6
MD5

524a63a2f02d538858d2e5fc224462f4
SHA1

442c8efab4ca9ec82410debf94a67287875e819e
SHA256

9a7a17645ae103f2b14917e1a71c56b6ae13c81ca09522ead4423358f9064725
SHA512

1362a2e3ff7c745963db07120d012b537e778cda0a2c7e2726e1eb0937285316e6d31d2f60f4d2b2f9be447baed101ad2b1a864c2ba9a65d452bc7bb8114e7e7
SSDEEP

12288:amyzOwFIOBRa8Rj8XUdtlA9W/cKoDLwBoNVbfahf:ByzOOBkw+0Z2MeNVTahf

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

remote

C2

dioslipper.no-ip.org:3460

Mutex

8W7O0NQ17EG0CJ

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
expIorer.exe
install_dir
treiber
install_file
driver.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate
regkey_hkcu
HKCUx1
regkey_hklm
HKLMx1

Targets

- Target
  
  9a7a17645ae103f2b14917e1a71c56b6ae13c81ca09522ead4423358f9064725
- Size
  
  492KB
- MD5
  
  524a63a2f02d538858d2e5fc224462f4
- SHA1
  
  442c8efab4ca9ec82410debf94a67287875e819e
- SHA256
  
  9a7a17645ae103f2b14917e1a71c56b6ae13c81ca09522ead4423358f9064725
- SHA512
  
  1362a2e3ff7c745963db07120d012b537e778cda0a2c7e2726e1eb0937285316e6d31d2f60f4d2b2f9be447baed101ad2b1a864c2ba9a65d452bc7bb8114e7e7
- SSDEEP
  
  12288:amyzOwFIOBRa8Rj8XUdtlA9W/cKoDLwBoNVbfahf:ByzOOBkw+0Z2MeNVTahf
Score

10^/10

cybergate remote bootkit persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Adds policy Run key to start application
  persistence
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Adds policy Run key to start application

Modifies Installed Components in the registry

UPX packed file

Adds Run key to start application

Writes to the Master Boot Record (MBR)

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2