cybergate | 6c787b3541dff4d6fe95db06b2dec81967b1654bb158db48f97ce15a831efb79

General

Target

6c787b3541dff4d6fe95db06b2dec81967b1654bb158db48f97ce15a831efb79
Size

362KB
Sample

221123-xnjr7sfe67
MD5

e419b18a6ab67fc9aff782fa1db2bdae
SHA1

9d41b9cd21e41cf473b6f91d77b87ce9e47a2cb1
SHA256

6c787b3541dff4d6fe95db06b2dec81967b1654bb158db48f97ce15a831efb79
SHA512

93cef648e0b8d9b3a41735c1422c2d3c4c2c7c973d59ffa3aac3a92bf9546bb6d58a65f95a9bc35891eba8cc7370aaa1198929a9ab9866d634ea50b5fdfaabe5
SSDEEP

6144:Nd5njLvzZK27S4N+mW+jdyPJFWUWc5Rvp5pkUx7Ke4NA:NrnjrlK27tUyR6dWcPB5pkIu

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Remote

C2

hasan331.no-ip.org:1819

Mutex

17GN65K0CI522W

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
rundll
install_file
rundll32.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Component 'WBCustomizer.dll' or one of its dependencies not correctly registered: a file is missing or invalid
message_box_title
Miss call bomber
password
1
regkey_hkcu
HKCU
regkey_hklm
HKLM

Targets

- Target
  
  6c787b3541dff4d6fe95db06b2dec81967b1654bb158db48f97ce15a831efb79
- Size
  
  362KB
- MD5
  
  e419b18a6ab67fc9aff782fa1db2bdae
- SHA1
  
  9d41b9cd21e41cf473b6f91d77b87ce9e47a2cb1
- SHA256
  
  6c787b3541dff4d6fe95db06b2dec81967b1654bb158db48f97ce15a831efb79
- SHA512
  
  93cef648e0b8d9b3a41735c1422c2d3c4c2c7c973d59ffa3aac3a92bf9546bb6d58a65f95a9bc35891eba8cc7370aaa1198929a9ab9866d634ea50b5fdfaabe5
- SSDEEP
  
  6144:Nd5njLvzZK27S4N+mW+jdyPJFWUWc5Rvp5pkUx7Ke4NA:NrnjrlK27tUyR6dWcPB5pkIu
Score

10^/10

cybergate remote persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Adds policy Run key to start application

Executes dropped EXE

Modifies Installed Components in the registry

UPX packed file

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2