cybergate | 56f2583edfe15a01c1f83269d1b0f9ec58d60e7f1b568c9b834de19aa3e8d35b

General

Target

56f2583edfe15a01c1f83269d1b0f9ec58d60e7f1b568c9b834de19aa3e8d35b
Size

591KB
Sample

221030-wzkyzaeecr
MD5

81a95c0e6fe616d8308819f6e78fe954
SHA1

460b78f22b031ae1710171fe232f254dd2048f1c
SHA256

56f2583edfe15a01c1f83269d1b0f9ec58d60e7f1b568c9b834de19aa3e8d35b
SHA512

0e598d0638b48a9e79ff4fbdbbd1092056d87db6ee2829b1593045e6f217b15aff784446d8119923d7da52e7a6d7c656a73b3c178eba71d9b474a98da9ac42ad
SSDEEP

12288:v6Wq4aaE6KwyF5L0Y2D1PqLE/ZYftCzogvCYoKYr:tthEVaPqLflCzrCYoKYr

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

daff

C2

boucraa.no-ip.org:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_file
Win_Xp.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Please try again later.
message_box_title
Error
password
abcd1234

Targets

- Target
  
  56f2583edfe15a01c1f83269d1b0f9ec58d60e7f1b568c9b834de19aa3e8d35b
- Size
  
  591KB
- MD5
  
  81a95c0e6fe616d8308819f6e78fe954
- SHA1
  
  460b78f22b031ae1710171fe232f254dd2048f1c
- SHA256
  
  56f2583edfe15a01c1f83269d1b0f9ec58d60e7f1b568c9b834de19aa3e8d35b
- SHA512
  
  0e598d0638b48a9e79ff4fbdbbd1092056d87db6ee2829b1593045e6f217b15aff784446d8119923d7da52e7a6d7c656a73b3c178eba71d9b474a98da9ac42ad
- SSDEEP
  
  12288:v6Wq4aaE6KwyF5L0Y2D1PqLE/ZYftCzogvCYoKYr:tthEVaPqLflCzrCYoKYr
Score

10^/10

cybergate daff persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Suspicious use of NtCreateProcessExOtherParentProcess

Executes dropped EXE

Modifies Installed Components in the registry

UPX packed file

Checks computer location settings

Loads dropped DLL

AutoIT Executable

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2