Overview

overview

10

Static

static

f8829e7ec8...96.exe

windows7-x64

10

f8829e7ec8...96.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196

  • Size

    482KB

  • Sample

    221106-e2lvlsehfk

  • MD5

    2d677ed795661959e60196d2892256b0

  • SHA1

    684d7f89ffc1822a10c8824d8c8da7079eca292a

  • SHA256

    f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196

  • SHA512

    eb11aa99ec8c1e658941b57a843be6ab8af6ffbee2d613d92d52cc01713505531255e55f5ef2e4d226ded8464c2cc892767b96358b41a545d3dd78bb8068c6f9

  • SSDEEP

    12288:9t2qQ7T6HFn3oRI2h11WoUXuTiN8FhNlJo2:OvyHFn4PBSYRFhny2

Score
10/10
cybergatevictimapersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Victima

C2

kbchorizo.no-ip.org:81

infeccioneszc.no-ip.org:81
Mutex

infeccion

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Win32

  • install_file

    winloader.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Your windows is not compatibility! error 503

  • message_box_title

    título da mensagem

  • password

    zc

  • regkey_hkcu

    Placa mother

  • regkey_hklm

    Tarjeta de video

Targets

    • Target

      f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196

    • Size

      482KB

    • MD5

      2d677ed795661959e60196d2892256b0

    • SHA1

      684d7f89ffc1822a10c8824d8c8da7079eca292a

    • SHA256

      f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196

    • SHA512

      eb11aa99ec8c1e658941b57a843be6ab8af6ffbee2d613d92d52cc01713505531255e55f5ef2e4d226ded8464c2cc892767b96358b41a545d3dd78bb8068c6f9

    • SSDEEP

      12288:9t2qQ7T6HFn3oRI2h11WoUXuTiN8FhNlJo2:OvyHFn4PBSYRFhny2

    Score
    10/10
    cybergatevictimapersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks