Overview

overview

10

Static

static

10

CALLOF~1.exe

windows7-x64

10

CALLOF~1.exe

windows10-2004-x64

10

PerX.exe

windows7-x64

8

PerX.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9246e9820b83ff485c8519aab228f275b837424af691b866739a5c873e78367

  • Size

    459KB

  • Sample

    221203-a2fldaad23

  • MD5

    346d1dee233a111902c17c73f3c7e92c

  • SHA1

    cdff18c89f3fd1c1ed210a5c68d8d7cb22c3bd23

  • SHA256

    b9246e9820b83ff485c8519aab228f275b837424af691b866739a5c873e78367

  • SHA512

    613fa71fc7b31f6d12a85eb8a64afb9ee4c2353a313eb216edf8e4dc23db0fac7816c70d7f380f6dcb7df81445034b1a03b19c252c4ab2af9d5b0dd6593f41b1

  • SSDEEP

    6144:XF/mJYZ9lBLdOPJwDh58QvcDc/RloSRy3vnveXXm8TYPtodm+0xwAPjn2U82xNk9:sJIOPY5QDcl9y3vveHVdm+xASL2UcF4b

Score
10/10
cybergatefalseremotepersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Botnet

FALSE

C2

ØØÎÙÏϼ¼êÕÎÈÉÝÐìÎÓÈÙßȼ¼êÕÎÈÉÝÐýÐÐÓß¼¼êÕÎÈÉÝÐúÎÙÙ¼¼¼ùÄÕÈìÎÓßÙÏϼ¼¼ðÏÝÿÐÓÏÙ¼¼ÿÎÅÌÈéÒÌÎÓÈÙßÈøÝÈݼ¼óÐÙõÒÕÈÕÝÐÕÆÙ¼¼¼ïÅÏúÎÙÙïÈÎÕÒÛ¼¼¼ìïÈÓÎÙÿÎÙÝÈÙõÒÏÈÝÒßÙ¼¼îÝÏùÒÉÑùÒÈÎÕÙÏý¼¼¼ïôûÙÈïÌÙßÕÝÐúÓÐØÙÎìÝÈÔý¼¼¼èÓýÏßÕÕ¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼V3-7P4J-XK3476X887JQ}

SearchIndexer

FALSE

16

0

CyberGate

Remote Administration anywhere in the world.

TRUE

ftp.server.com

./logs/

ftp_user

ªš÷Öº+Þ

21

30
Mutex

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • install_dir

    FALSE

  • install_file

    FALSE

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    TRUE

  • message_box_title

    TRUE

  • password

    FALSE

  • regkey_hkcu

    FALSE

  • regkey_hklm

    FALSE

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

ikhackjou.no-ip.org:1540

Mutex

LP5QFHQ655CF72

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    services.exe

  • install_dir

    Systeem32

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    hoi123

  • regkey_hkcu

    SearchIndexer

  • regkey_hklm

    SearchIndexer

Targets

    • Target

      CALLOF~1.EXE

    • Size

      270KB

    • MD5

      e14244a052136335c003492c75cedcbe

    • SHA1

      c7a73e6efbe3c44a42dbdd8dde0fd2cb7bb000ee

    • SHA256

      f4a501d135d291fd0d23dea3faf2640e9ea7dcc1a48402e55634775e32203f48

    • SHA512

      dba313f60734ac8c4891dd68b83d82182404344450223988684d449deebff6c5b1cd098bc729b267a237b800d1ee23ceaff8b292e26133b8bbc1ef74475be24f

    • SSDEEP

      6144:TMq0ftzddwSbRnY8EhscQE8uNaWiyULbYsXarJo5H:TFIt5jKRKrZ2a7yWbYaarJo5

    Score
    10/10
    cybergateremotepersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

    • Target

      PerX.exe

    • Size

      262KB

    • MD5

      e974a7ed7fa0c096aa1f59ae6d8cce72

    • SHA1

      24b215e712fa745ac94d033ee7c5a556a5df0dab

    • SHA256

      d042a6add7b1547e5165d0c0c0f0eb21ee778b44c27e0a2bbce9f02b79156c0b

    • SHA512

      156cfa7b252d8737a4d3fdc3f8095353051d7f15e1293d6c1213de36ea44d526fd94e75765b3a1f75ed83f9b02dd4329b9eab466e9188fea107e622d0c1d6ba4

    • SSDEEP

      6144:jYPOodm30xwcP9n2U82xZkckexoS8pm97WQP:Ydm3xc4L24cVoS8c97Wy

    Score
    8/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks