Overview

overview

10

Static

static

BOT181~1.exe

windows7-x64

1

BOT181~1.exe

windows10-2004-x64

1

wewe.exe

windows7-x64

10

wewe.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    88a2238e9a1006139a1a3cb14873c15cc1482ed6e81ffdd960df59950477f0d2

  • Size

    336KB

  • Sample

    221201-1jd8psdd64

  • MD5

    ac57bee93c9d8e271426efd32a7de11e

  • SHA1

    fffb7e81dfdc0cdcb254617926b4dd3dfbf9aa63

  • SHA256

    88a2238e9a1006139a1a3cb14873c15cc1482ed6e81ffdd960df59950477f0d2

  • SHA512

    a6c8bfc2ad8c1d1111d75e1620aa5c64fdc1b2448ab0e338086bcd9eb026fd7577325714a56a832d05d8d0308346c4ff11382fd2fc6cbd0f2134282757d7edc5

  • SSDEEP

    6144:8xk4ILTd2L/x0TKfnzsgqDZlcD3i5gTR29BTl/D1Q4nxS5WT62Rzj2xnmrPIz+o:+DI87x0ufnzjiZl8ied2bRp85WT6IX2h

Score
10/10
cybergateemrepersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.02.0

Botnet

emre

C2

127.0.0.1:999

delikralll.dyndns.org:999
Mutex

CyberGate1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1111

Targets

    • Target

      BOT181~1.EXE

    • Size

      788KB

    • MD5

      da4dca923b05cd77df8fc963ba9791be

    • SHA1

      bdb96f8563e24cdeca1bf9a06886b0cd65df8a4b

    • SHA256

      33a37b9bf60e9c8216f5d3e8ce76596de12dc98f652e31e3c0149ace1d28cfa6

    • SHA512

      6330d9715920ce544575ce825b39e2c0c5fea370d19cb4cb0cb0897434f16056901014be76bddb0ee33eedd2a9d97a8db12b7aa3c6a5581c8d0e1d1c66a7a3ae

    • SSDEEP

      3072:jKP/SuhDQsk/uXLBre8YzTzjyG9Iph7OLb34dlTwN/uXLBre8YzTzjyG9Iph7OLi:uNcXNXxLNMXbjXb

    Score
    1/10
    behavioral1behavioral2

    • Target

      wewe.EXE

    • Size

      316KB

    • MD5

      99de15e5b9fb3e4659833c37ec99d5cc

    • SHA1

      1db9bccaf7d387342b435e2cdd652162919f9c89

    • SHA256

      ee6e5c5318af78df79817ba1ce116060a711552bf6818c9c6f2c5568a5d1b45c

    • SHA512

      d32f37e9ff55b41669348e221f8170b6644ab3744a201e0cb37d2b26bf6c892a5ddf4f580d0d06f200a9dcc4aa7ec1339247a71c516409186b47356c61330655

    • SSDEEP

      6144:lCJONhmxghUCHztYhoO3WhE1PM+ahhy+XP1i9Uo0M1:96ghUMztYdWh8U+AXti9Ug

    Score
    10/10
    cybergateemrepersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks