cybergate | ce35e95486dde2d4a87963f40aa887c3885ce5ec73d8f9ea73e6aef7fa3a15c6

General

Target

ce35e95486dde2d4a87963f40aa887c3885ce5ec73d8f9ea73e6aef7fa3a15c6
Size

426KB
Sample

221123-s98agage6w
MD5

438667f73e7f085f52180a45edaaf3ba
SHA1

94b2c6f21f7623f78f05ca66d75a9219622c1e49
SHA256

ce35e95486dde2d4a87963f40aa887c3885ce5ec73d8f9ea73e6aef7fa3a15c6
SHA512

bcd7efba57ac29fd006316dfcf446e656bb898727f004c975fbd3e89e8cfd50681a42d3dddebf85fd69beeb5e326b1d96ac4e3dd5bd54ca24bd60c6d7ef02522
SSDEEP

6144:R/0uoEpLqaaYOfRB1I1EgXjR5P65E4ih6vWRdb0ILthhKAyeev7ydDINvLNCtKGR:RJlQfoz9kEPgO3/evOCNAJ55O7lcfkj+

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

127.0.0.1:81

chabchoub.no-ip.info:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234

Targets

- Target
  
  ce35e95486dde2d4a87963f40aa887c3885ce5ec73d8f9ea73e6aef7fa3a15c6
- Size
  
  426KB
- MD5
  
  438667f73e7f085f52180a45edaaf3ba
- SHA1
  
  94b2c6f21f7623f78f05ca66d75a9219622c1e49
- SHA256
  
  ce35e95486dde2d4a87963f40aa887c3885ce5ec73d8f9ea73e6aef7fa3a15c6
- SHA512
  
  bcd7efba57ac29fd006316dfcf446e656bb898727f004c975fbd3e89e8cfd50681a42d3dddebf85fd69beeb5e326b1d96ac4e3dd5bd54ca24bd60c6d7ef02522
- SSDEEP
  
  6144:R/0uoEpLqaaYOfRB1I1EgXjR5P65E4ih6vWRdb0ILthhKAyeev7ydDINvLNCtKGR:RJlQfoz9kEPgO3/evOCNAJ55O7lcfkj+
Score

10^/10

cybergate sality vítima backdoor evasion persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2