cybergate | 562405929b8de1d05cae02c1e654c21a7a961e5ef07c83f4c6d764194e0f46d0

General

Target

562405929b8de1d05cae02c1e654c21a7a961e5ef07c83f4c6d764194e0f46d0
Size

4.0MB
Sample

221123-lwq1pscd82
MD5

dbf7cf4242162d9f96442d091081cb84
SHA1

729aabddc27569be04af0dd261249bddec0321cd
SHA256

562405929b8de1d05cae02c1e654c21a7a961e5ef07c83f4c6d764194e0f46d0
SHA512

8a7e3f693acc936343a4d671ee8009b049ba4b8a22c978997e4ffd91cb0b78732d048a89620a016cfa4db838c4772d0e2f79e9bfe91a8a885948c1f418c1b8fe
SSDEEP

98304:wCjPKNZ0StVb4sUbpoyOmibD+Zupx8xNGVh:wCbGWWELpoyOm6veNGh

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

update14/08

C2

joujounette974.ddns.net:8027

Mutex

4fa07418dc12247f287b9c9760beff66

Attributes

reg_key
4fa07418dc12247f287b9c9760beff66
splitter
|'|'|

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

VPN4

C2

joujounette974.ddns.net:8027

Mutex

64M5FRUGH772A6

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
HWID Generator is actually down. Please come back later.Sorry for inconvenience.
message_box_title
HWID Generator Error!!
password
123456

Targets

- Target
  
  562405929b8de1d05cae02c1e654c21a7a961e5ef07c83f4c6d764194e0f46d0
- Size
  
  4.0MB
- MD5
  
  dbf7cf4242162d9f96442d091081cb84
- SHA1
  
  729aabddc27569be04af0dd261249bddec0321cd
- SHA256
  
  562405929b8de1d05cae02c1e654c21a7a961e5ef07c83f4c6d764194e0f46d0
- SHA512
  
  8a7e3f693acc936343a4d671ee8009b049ba4b8a22c978997e4ffd91cb0b78732d048a89620a016cfa4db838c4772d0e2f79e9bfe91a8a885948c1f418c1b8fe
- SSDEEP
  
  98304:wCjPKNZ0StVb4sUbpoyOmibD+Zupx8xNGVh:wCbGWWELpoyOm6veNGh
Score

10^/10

cybergate njrat update14/08 vpn4 evasion persistence spyware stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Modifies WinLogon for persistence
  persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2