Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

89778ce024...8a.exe

windows7-x64

10

89778ce024...8a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    89778ce0244a2c98093577bbc90461f9fcf6b18cd3b932c9b49c174a452e678a

  • Size

    448KB

  • Sample

    221003-rgn6fsade8

  • MD5

    632b7b0eae2f335fa0e303e7574318e2

  • SHA1

    22ba636c019ee376a7c40b8077ab2100b9931465

  • SHA256

    89778ce0244a2c98093577bbc90461f9fcf6b18cd3b932c9b49c174a452e678a

  • SHA512

    8eb5ff03416610841b63e66c2e1574b2a111ef27d18d710b8b47b6651581e789a083ef081dd9f6d3338fde9936b91e70f1fd4f73fd0619c615bcdf4684850918

  • SSDEEP

    12288:+ViAV0I8n+ql7rtkyr3naDKKr8lVlq2jl:hI8+k7riDSPlq2j

Score
10/10
cybergatefixpersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v2.1.0

Botnet

FiX

C2

jjleo.no-ip.biz:8220

Mutex

4Y853V6X16WU4N

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    services.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    jntdkb820

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      89778ce0244a2c98093577bbc90461f9fcf6b18cd3b932c9b49c174a452e678a

    • Size

      448KB

    • MD5

      632b7b0eae2f335fa0e303e7574318e2

    • SHA1

      22ba636c019ee376a7c40b8077ab2100b9931465

    • SHA256

      89778ce0244a2c98093577bbc90461f9fcf6b18cd3b932c9b49c174a452e678a

    • SHA512

      8eb5ff03416610841b63e66c2e1574b2a111ef27d18d710b8b47b6651581e789a083ef081dd9f6d3338fde9936b91e70f1fd4f73fd0619c615bcdf4684850918

    • SSDEEP

      12288:+ViAV0I8n+ql7rtkyr3naDKKr8lVlq2jl:hI8+k7riDSPlq2j

    Score
    10/10
    cybergatefixpersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks