General

  • Target

    17ad873381566e1428cf5d0cb36a9d533926138843c8e658ee970462a5912632

  • Size

    644KB

  • Sample

    221128-m9vrgsdg7z

  • MD5

    42d92860641858293168711b52ca8a22

  • SHA1

    340c35f46bb6eaba3136cd4dd5cb93984cd16e43

  • SHA256

    17ad873381566e1428cf5d0cb36a9d533926138843c8e658ee970462a5912632

  • SHA512

    7d1b015e549bd3d4cba7943bcd8622d708d7cf11512e436d16bf1bc3d93525db058a54271f2f25215b046c12222c1e32117dcb2678bcf262d3673922d56c8ada

  • SSDEEP

    12288:Fu+I2ndBj2zipL4sF7ck6ePNqvkOd+C9jBsm3rAQeZDglJLobyQqVtQhU7:rBnmzjm4k6cNqsOdKm7deNMNYyQqV5

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

l2ru

C2

brosto.strangled.net:81

brosto.strangled.net:4123

brosto.strangled.net:6745

brosto.strangled.net:7534

brosto.strangled.net:7653

sasaze.chickenkiller.com:7875

sasaze.chickenkiller.com:8545

sasaze.chickenkiller.com:8642

sasaze.chickenkiller.com:8742

sasaze.chickenkiller.com:8954

brostod.jumpingcrab.com:9647

brostod.jumpingcrab.com:9743

brostod.jumpingcrab.com:9866

brostod.jumpingcrab.com:10535

brostod.jumpingcrab.com:10877

1844205166:53575

1844205166:58656

1844205166:59534

1844205166:59642

Mutex

R7S56282M47S01

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    interface

  • install_file

    csrsc.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    a123123123

  • regkey_hkcu

    exploruse

  • regkey_hklm

    exploruse

Targets

    • Target

      17ad873381566e1428cf5d0cb36a9d533926138843c8e658ee970462a5912632

    • Size

      644KB

    • MD5

      42d92860641858293168711b52ca8a22

    • SHA1

      340c35f46bb6eaba3136cd4dd5cb93984cd16e43

    • SHA256

      17ad873381566e1428cf5d0cb36a9d533926138843c8e658ee970462a5912632

    • SHA512

      7d1b015e549bd3d4cba7943bcd8622d708d7cf11512e436d16bf1bc3d93525db058a54271f2f25215b046c12222c1e32117dcb2678bcf262d3673922d56c8ada

    • SSDEEP

      12288:Fu+I2ndBj2zipL4sF7ck6ePNqvkOd+C9jBsm3rAQeZDglJLobyQqVtQhU7:rBnmzjm4k6cNqsOdKm7deNMNYyQqV5

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks