Overview

overview

10

Static

static

d06e06b5d0...83.exe

windows7-x64

10

d06e06b5d0...83.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83

  • Size

    925KB

  • Sample

    221130-zvc94shc6v

  • MD5

    a00431dcc67702ab053c7a9ff6d70d76

  • SHA1

    88bea417a1dd22009b54949921cf88944cea0072

  • SHA256

    d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83

  • SHA512

    d7dee7fc0e8d2874233caafab69230e104980b4d7a8057384f32325aa56e61ebf4a8e8fef23cb7348042e3aa6353973cc3d263895484896b7c78bfbfc13e2c4e

  • SSDEEP

    12288:oNolnOK+cCKw3KAggIUc0VcCKw3gqu+x7wcg7KVZBjIx6Dx0xCUdTUkHVg96k6xs:FnEmKhd7YcZBjvOxCwSwjHxa5sGH

Score
10/10
cybergate1stealertrojan

Malware Config

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

1

C2

46.160.78.58:1550

46.160.78.58:2500

46.160.78.58:10000

46.160.78.58:54565
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83

    • Size

      925KB

    • MD5

      a00431dcc67702ab053c7a9ff6d70d76

    • SHA1

      88bea417a1dd22009b54949921cf88944cea0072

    • SHA256

      d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83

    • SHA512

      d7dee7fc0e8d2874233caafab69230e104980b4d7a8057384f32325aa56e61ebf4a8e8fef23cb7348042e3aa6353973cc3d263895484896b7c78bfbfc13e2c4e

    • SSDEEP

      12288:oNolnOK+cCKw3KAggIUc0VcCKw3gqu+x7wcg7KVZBjIx6Dx0xCUdTUkHVg96k6xs:FnEmKhd7YcZBjvOxCwSwjHxa5sGH

    Score
    10/10
    cybergate1stealertrojan

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks