cybergate | 31a9e0a3126f40752d10b25845391c8b9c93c45cf1581612274e587cfc419b43

General

Target

31a9e0a3126f40752d10b25845391c8b9c93c45cf1581612274e587cfc419b43
Size

461KB
Sample

221125-dmmmxsgb82
MD5

9230a3152d1c4336eca063c440c72b83
SHA1

67ffe7f0f66c0b7e66f7c4527aaf688c6170d21d
SHA256

31a9e0a3126f40752d10b25845391c8b9c93c45cf1581612274e587cfc419b43
SHA512

39549ec370500843275c30a723634fb8d8ec9020fab746efd0c8e4eaa981d8cdea47e16ae4017044bf179f7d4b50af40152ab6af43da77b52fbc83c0ef40de4c
SSDEEP

12288:00blnvU+Y0j1jIwHm8Xqb7sz0rX2w71eQ+olhSS:00bln8+Y0J1mBoz0rXL71eMlh

Score

10^/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

mylifemylife.no-ip.org:82

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_file
Win_Xp.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Please try again later.
message_box_title
Error
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Targets

- Target
  
  31a9e0a3126f40752d10b25845391c8b9c93c45cf1581612274e587cfc419b43
- Size
  
  461KB
- MD5
  
  9230a3152d1c4336eca063c440c72b83
- SHA1
  
  67ffe7f0f66c0b7e66f7c4527aaf688c6170d21d
- SHA256
  
  31a9e0a3126f40752d10b25845391c8b9c93c45cf1581612274e587cfc419b43
- SHA512
  
  39549ec370500843275c30a723634fb8d8ec9020fab746efd0c8e4eaa981d8cdea47e16ae4017044bf179f7d4b50af40152ab6af43da77b52fbc83c0ef40de4c
- SSDEEP
  
  12288:00blnvU+Y0j1jIwHm8Xqb7sz0rX2w71eQ+olhSS:00bln8+Y0J1mBoz0rXL71eMlh
Score

10^/10

cybergate öííé persistence stealer trojan upx
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

CyberGate, Rebhip

Adds policy Run key to start application

Executes dropped EXE

Modifies Installed Components in the registry

UPX packed file

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2