General

  • Target

    fb7847373477a5148f190949c130977367bfee8c854811ee96381a6cbc54ac4d

  • Size

    365KB

  • Sample

    221106-hj53bagfb7

  • MD5

    211f5b91e02cce9155adcbb0ad9233f0

  • SHA1

    2a04655504ec02036e750aa8c3aff776df9b7b14

  • SHA256

    fb7847373477a5148f190949c130977367bfee8c854811ee96381a6cbc54ac4d

  • SHA512

    ab81533d0eac4ae885871f6d4991bdc97ce6ae2fb35cb26bde5e8a987338f32b5aee033a5fd437d9cc14fb4db3a0b9ebc4e6b31fd93497e33b2afadb126894f3

  • SSDEEP

    6144:TgLxtJnhCM9GFgCiBoQXIEes8BN70i8DIHIhojbEOihmVl6i+YhBMsEYNrK:UoFgPBlXHeNNcDajHEORl6i+YsWZK

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

new504

C2

Firefox.ignorelist.com:82

Mutex

drd78sv8edrj

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    dwm.exe

  • install_dir

    Mozilla

  • install_file

    Flash_Update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Notice: Undefined index: template in /opt/lampp/htdocs/install/index.php on line 17 Notice: Undefined index: language in /opt/lampp/htdocs/install/index.php on line 21 Notice: Use of undefined constant _logout_true - assumed '_logout_true' in /opt/lampp/htdocs/inc/_lang/english.php on line 17 Notice: Use of undefined constant _login_true - assumed '_login_true' in /opt/lampp/htdocs/inc/_lang/english.php on line 18 Notice: Use of undefined constant _login_false_pwd - assumed '_login_false_pwd' in /opt/lampp/htdocs/inc/_lang/english.php on line 19 Notice: Use of undefined constant _login_false_name - assumed '_login_false_name' in /opt/lampp/htdocs/inc/_lang/english.php on line 20 Notice: Use of undefined constant _login_not_active_map - assumed '_login_not_active_map' in /opt/lampp/htdocs/inc/_lang/english.php on line 21 Notice: Use of undefined constant _save_area - assumed '_save_area' in /opt/lampp/htdocs/inc/_lang/english.php on line 23

  • message_box_title

    ERROR

  • password

    1234abc

  • regkey_hkcu

    Flash_Update

  • regkey_hklm

    Java_Update

Targets

    • Target

      fb7847373477a5148f190949c130977367bfee8c854811ee96381a6cbc54ac4d

    • Size

      365KB

    • MD5

      211f5b91e02cce9155adcbb0ad9233f0

    • SHA1

      2a04655504ec02036e750aa8c3aff776df9b7b14

    • SHA256

      fb7847373477a5148f190949c130977367bfee8c854811ee96381a6cbc54ac4d

    • SHA512

      ab81533d0eac4ae885871f6d4991bdc97ce6ae2fb35cb26bde5e8a987338f32b5aee033a5fd437d9cc14fb4db3a0b9ebc4e6b31fd93497e33b2afadb126894f3

    • SSDEEP

      6144:TgLxtJnhCM9GFgCiBoQXIEes8BN70i8DIHIhojbEOihmVl6i+YhBMsEYNrK:UoFgPBlXHeNNcDajHEORl6i+YsWZK

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks