cybergate | d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83

General

Target

d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
Size

925KB
MD5

a00431dcc67702ab053c7a9ff6d70d76
SHA1

88bea417a1dd22009b54949921cf88944cea0072
SHA256

d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83
SHA512

d7dee7fc0e8d2874233caafab69230e104980b4d7a8057384f32325aa56e61ebf4a8e8fef23cb7348042e3aa6353973cc3d263895484896b7c78bfbfc13e2c4e
SSDEEP

12288:oNolnOK+cCKw3KAggIUc0VcCKw3gqu+x7wcg7KVZBjIx6Dx0xCUdTUkHVg96k6xs:FnEmKhd7YcZBjvOxCwSwjHxa5sGH

Score

10^/10

cybergate 1 stealer trojan

Malware Config

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

1

C2

46.160.78.58:1550

46.160.78.58:2500

46.160.78.58:10000

46.160.78.58:54565

Mutex

***MUTEX***

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
1
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Suspicious use of SetThreadContext 1 IoCs

Processes:

d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe

description	pid	process	target process
PID 2036 set thread context of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe

pid process

1316 d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe

pid	process
1316	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe

description	pid	process	target process
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
PID 2036 wrote to memory of 1316	2036	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe	d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe

C:\Users\Admin\AppData\Local\Temp\d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
"C:\Users\Admin\AppData\Local\Temp\d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
C:\Users\Admin\AppData\Local\Temp\d06e06b5d049276db3c8156caa8be8222997151b6ed4b120ce37c7efd3c02b83.exe
2⤵
- Suspicious use of UnmapMainImage
PID:1316

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-55-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1316-59-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1316-58-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1316-56-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1316-62-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1316-63-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1316-60-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1316-65-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1316-66-0x000000000040BBF4-mapping.dmp

Download
memory/2036-54-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/2036-61-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-67-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing