Overview

overview

10

Static

static

83d7ac5697...9f.exe

windows7-x64

10

83d7ac5697...9f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    83d7ac56971351961f253da3cb056db018cbc589d773a3904964192436b97a9f

  • Size

    615KB

  • Sample

    221030-pvlw5sbaa9

  • MD5

    92e0ccae1b1ee4854c7bdfc26a0da560

  • SHA1

    a5b39511b2f27e67fc21b2aaabacb7f106b636e5

  • SHA256

    83d7ac56971351961f253da3cb056db018cbc589d773a3904964192436b97a9f

  • SHA512

    8cba9371698a26757b7044f7a90df0cfaec7c499f9186d114878a044ad7120584090e14fb8f5f7d11f352c3938c3393a7706558e31fe2d594a139652323f4f05

  • SSDEEP

    12288:mWeVQkTrvj4UHq7Z+4EpIeKB+Y7WKXxAcrjFNH9f3Fw4zKPoOIajiW9jYn:mDQkTf4UAVEpIf+mtxAcrjD9VRKPTII

Score
10/10
cybergatehackpersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

hack

C2

helpdisk00.zapto.org:288

Mutex

***MUTE0X***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    my network.exe

  • install_dir

    win0s

  • install_file

    Win_7.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Please try again later.

  • message_box_title

    Error

  • password

    abcd1234

  • regkey_hkcu

    HKC0U

  • regkey_hklm

    HKL0M

Targets

    • Target

      83d7ac56971351961f253da3cb056db018cbc589d773a3904964192436b97a9f

    • Size

      615KB

    • MD5

      92e0ccae1b1ee4854c7bdfc26a0da560

    • SHA1

      a5b39511b2f27e67fc21b2aaabacb7f106b636e5

    • SHA256

      83d7ac56971351961f253da3cb056db018cbc589d773a3904964192436b97a9f

    • SHA512

      8cba9371698a26757b7044f7a90df0cfaec7c499f9186d114878a044ad7120584090e14fb8f5f7d11f352c3938c3393a7706558e31fe2d594a139652323f4f05

    • SSDEEP

      12288:mWeVQkTrvj4UHq7Z+4EpIeKB+Y7WKXxAcrjFNH9f3Fw4zKPoOIajiW9jYn:mDQkTf4UAVEpIf+mtxAcrjD9VRKPTII

    Score
    10/10
    cybergatehackpersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks