cybergate | eca370714cffc52def1b513f8813c771bdb4735c4063498cd81ab42bd452ae2b

General

Target

eca370714cffc52def1b513f8813c771bdb4735c4063498cd81ab42bd452ae2b
Size

336KB
Sample

221004-d4ptlsahgl
MD5

69d0cba10d41ffaded42a429d339c5a5
SHA1

30f6aac8ba2883f098d23d2448b52dc4592fdec6
SHA256

eca370714cffc52def1b513f8813c771bdb4735c4063498cd81ab42bd452ae2b
SHA512

51e6e9e3d4590b75e0f805805450a15eb8ef25f94121c9031598ba79312f02ec156f9fee840f4d4b8607955896f1e37045587d4b4a85b925b36c460dd52937f2
SSDEEP

6144:qOpslFlqphdBCkWYxuukP1pjSKSNVkq/MVJb3D68ws:qwslWTBd47GLRMTb3D68ws

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Test

C2

nekisamja.no-ip.biz:85

127.0.0.1:999

Mutex

L38D5PV8S47081

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
explorer.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
156577_a
regkey_hkcu
HKCU
regkey_hklm
HKLM

Targets

- Target
  
  eca370714cffc52def1b513f8813c771bdb4735c4063498cd81ab42bd452ae2b
- Size
  
  336KB
- MD5
  
  69d0cba10d41ffaded42a429d339c5a5
- SHA1
  
  30f6aac8ba2883f098d23d2448b52dc4592fdec6
- SHA256
  
  eca370714cffc52def1b513f8813c771bdb4735c4063498cd81ab42bd452ae2b
- SHA512
  
  51e6e9e3d4590b75e0f805805450a15eb8ef25f94121c9031598ba79312f02ec156f9fee840f4d4b8607955896f1e37045587d4b4a85b925b36c460dd52937f2
- SSDEEP
  
  6144:qOpslFlqphdBCkWYxuukP1pjSKSNVkq/MVJb3D68ws:qwslWTBd47GLRMTb3D68ws
Score

10^/10

cybergate test persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Adds policy Run key to start application

Executes dropped EXE

Modifies Installed Components in the registry

UPX packed file

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2