Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f1d1aff1630f101bd58c10e1104a7b85d2005a813d394e074f7f2bb632f9bf23

  • Size

    284KB

  • Sample

    221125-yjyagaeb2t

  • MD5

    09b935d6cbba89efaaf140dd4eb59336

  • SHA1

    b3609d7fb44e698b9c2d407a34bd98a903329c49

  • SHA256

    f1d1aff1630f101bd58c10e1104a7b85d2005a813d394e074f7f2bb632f9bf23

  • SHA512

    05e69236fcd28c3f267a32d21285fe6cc645bf97be4ecc254895e982af3aad21ddd2f8c146f20851e610592f050d60d1eb7b119d6241054984f22e59f61504d4

  • SSDEEP

    6144:+k4qmxdvZr/KCbCZXw/MnTA/9u3k+0qS6HINLYAHL:h9wrrCCbZNVu3kvoA

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

127.0.0.1:288

127.0.0.1:1177

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    t?tulo da mensagem

  • password

    123456

Targets

    • Target

      f1d1aff1630f101bd58c10e1104a7b85d2005a813d394e074f7f2bb632f9bf23

    • Size

      284KB

    • MD5

      09b935d6cbba89efaaf140dd4eb59336

    • SHA1

      b3609d7fb44e698b9c2d407a34bd98a903329c49

    • SHA256

      f1d1aff1630f101bd58c10e1104a7b85d2005a813d394e074f7f2bb632f9bf23

    • SHA512

      05e69236fcd28c3f267a32d21285fe6cc645bf97be4ecc254895e982af3aad21ddd2f8c146f20851e610592f050d60d1eb7b119d6241054984f22e59f61504d4

    • SSDEEP

      6144:+k4qmxdvZr/KCbCZXw/MnTA/9u3k+0qS6HINLYAHL:h9wrrCCbZNVu3kvoA

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks