Overview

overview

10

Static

static

526b75b897...24.exe

windows7-x64

10

526b75b897...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    526b75b897aab1a6e602a88582ff7b5d49601b56a29ceefab572e16aaf1b5524

  • Size

    376KB

  • Sample

    221021-kzml1scee5

  • MD5

    4ab133bb71df316d53755daa72103c10

  • SHA1

    ee9a8dbdb6e11009ece80ce6ee7493f31601a7ee

  • SHA256

    526b75b897aab1a6e602a88582ff7b5d49601b56a29ceefab572e16aaf1b5524

  • SHA512

    a8b87b3a3c7fe88f0bb1531d0bbcde8fa755d600e687067fbc28acb926bcdcb1f3acfbc3f333bd634d9de67e79e277f1ec77b17028aeb0f3a786ac6c04a03b91

  • SSDEEP

    6144:oDYffB4hqI4OKYVB/e5SaEpb1KvIED8baiu69coCKUxibiYh0iXUqBCEo:oDYffB4wI4vsxCnEpeNv69GVY6i9o

Score
10/10
cybergatehackpersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Hack

C2

sistematryo2012.no-ip.org:2000

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    schost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1234

Targets

    • Target

      526b75b897aab1a6e602a88582ff7b5d49601b56a29ceefab572e16aaf1b5524

    • Size

      376KB

    • MD5

      4ab133bb71df316d53755daa72103c10

    • SHA1

      ee9a8dbdb6e11009ece80ce6ee7493f31601a7ee

    • SHA256

      526b75b897aab1a6e602a88582ff7b5d49601b56a29ceefab572e16aaf1b5524

    • SHA512

      a8b87b3a3c7fe88f0bb1531d0bbcde8fa755d600e687067fbc28acb926bcdcb1f3acfbc3f333bd634d9de67e79e277f1ec77b17028aeb0f3a786ac6c04a03b91

    • SSDEEP

      6144:oDYffB4hqI4OKYVB/e5SaEpb1KvIED8baiu69coCKUxibiYh0iXUqBCEo:oDYffB4wI4vsxCnEpeNv69GVY6i9o

    Score
    10/10
    cybergatehackpersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks