Overview

overview

10

Static

static

1abef2e31a...61.exe

windows7-x64

10

1abef2e31a...61.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1abef2e31a34cee723d7ab5ca564f3287634d53f5a13f8d875161800ebeb7261

  • Size

    534KB

  • Sample

    221029-2zb9qabdel

  • MD5

    848d53251359f988de7587c9e53ab860

  • SHA1

    0f389b6cf4b1f68760dce27f62250303fee10e7b

  • SHA256

    1abef2e31a34cee723d7ab5ca564f3287634d53f5a13f8d875161800ebeb7261

  • SHA512

    62777b701f6b8a6d4e22f896ac7fab38751e5f3a8e1bb01fe8c395c0036d11199d54f2fe78c166781904a6469b23f003dffdcd5eb52c54518bbf5d152c0a803d

  • SSDEEP

    12288:Kojv+5Do4cYgaDRBPJ4cXSXL9LVCuI3l+vk:7+5nPMESXL9RCuI3lf

Score
10/10
cybergatefuck youevasionpersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

fuck you

C2

khaled25.no-ip.biz:81

khaled25.no-ip.biz:80

khaled25.no-ip.biz:82

khaled25.no-ip.biz:83

khaled25.no-ip.biz:84

khaled25.no-ip.biz:85
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      1abef2e31a34cee723d7ab5ca564f3287634d53f5a13f8d875161800ebeb7261

    • Size

      534KB

    • MD5

      848d53251359f988de7587c9e53ab860

    • SHA1

      0f389b6cf4b1f68760dce27f62250303fee10e7b

    • SHA256

      1abef2e31a34cee723d7ab5ca564f3287634d53f5a13f8d875161800ebeb7261

    • SHA512

      62777b701f6b8a6d4e22f896ac7fab38751e5f3a8e1bb01fe8c395c0036d11199d54f2fe78c166781904a6469b23f003dffdcd5eb52c54518bbf5d152c0a803d

    • SSDEEP

      12288:Kojv+5Do4cYgaDRBPJ4cXSXL9LVCuI3l+vk:7+5nPMESXL9RCuI3lf

    Score
    10/10
    cybergatefuck youevasionpersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks