Overview

overview

10

Static

static

d9c8c01f01...89.exe

windows7-x64

10

d9c8c01f01...89.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d9c8c01f01cec927dbdb0cc78499f20cc7bd473dac286eab6c954ad013256889

  • Size

    352KB

  • Sample

    221030-tarn4shgfl

  • MD5

    82c0451a271759749440739b8e741700

  • SHA1

    33206f7c7ed90204518b56f4e56472480642e136

  • SHA256

    d9c8c01f01cec927dbdb0cc78499f20cc7bd473dac286eab6c954ad013256889

  • SHA512

    af85ac8a46c0e995a9afeba3ea8d5bac630be1fda6147ecfb0b5fec05c1a238a63a7432feacbee235d448b61e61dd772310da6443295e1a7a1c857009fc683cd

  • SSDEEP

    6144:dzlN2bXMj/rY18frMCzQXX4chnHJcwM6bE1cYojzuWgnw/BVLiv84IodD8Rw6:PNuXMj/rY18zMH42HTzIiYojLOdIod4

Score
10/10
cybergatecallaitoopersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

callaitoo

C2

callaitoo.no-ip.org:82

127.0.0.1:82
Mutex

EB8ST65FTIYF04

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    rundll

  • install_file

    rundll32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    200685

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      d9c8c01f01cec927dbdb0cc78499f20cc7bd473dac286eab6c954ad013256889

    • Size

      352KB

    • MD5

      82c0451a271759749440739b8e741700

    • SHA1

      33206f7c7ed90204518b56f4e56472480642e136

    • SHA256

      d9c8c01f01cec927dbdb0cc78499f20cc7bd473dac286eab6c954ad013256889

    • SHA512

      af85ac8a46c0e995a9afeba3ea8d5bac630be1fda6147ecfb0b5fec05c1a238a63a7432feacbee235d448b61e61dd772310da6443295e1a7a1c857009fc683cd

    • SSDEEP

      6144:dzlN2bXMj/rY18frMCzQXX4chnHJcwM6bE1cYojzuWgnw/BVLiv84IodD8Rw6:PNuXMj/rY18zMH42HTzIiYojLOdIod4

    Score
    10/10
    cybergatecallaitoopersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks