Overview

overview

10

Static

static

990519661a...5b.exe

windows7-x64

10

990519661a...5b.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    990519661a04ffe23b87896ebeda1ea365eee686029998f37568c34d6987bd5b

  • Size

    304KB

  • Sample

    221203-t97jlsgg85

  • MD5

    c13998fd479abc6389bf1a91c78a7fc9

  • SHA1

    57f07de50453f9c8d142b334ceab07e15ee163f5

  • SHA256

    990519661a04ffe23b87896ebeda1ea365eee686029998f37568c34d6987bd5b

  • SHA512

    f4e1e847d5d9df36ec51f48a1ee420da6e97e9b7fde8d8734e8b8e2ee5e2f253c4f07fcee57cd86c83680af7c77bb3da8ece39431fd7cf721f02212da187a0de

  • SSDEEP

    6144:lMVQL+S2kVowHrb9yo4dnx3pV083rCkeVsAl/PXI+gbrITb7+:yPkVokMXVNrVXO/P47brIz+

Score
10/10
cybergatelammerpersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Lammer

C2

pega.no-ip.org:2001

Mutex

Pluguin

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft

  • install_file

    Pluguin.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.

  • message_box_title

    LAMMER

  • password

    123

  • regkey_hkcu

    Avirnt

  • regkey_hklm

    Avgnt

Targets

    • Target

      990519661a04ffe23b87896ebeda1ea365eee686029998f37568c34d6987bd5b

    • Size

      304KB

    • MD5

      c13998fd479abc6389bf1a91c78a7fc9

    • SHA1

      57f07de50453f9c8d142b334ceab07e15ee163f5

    • SHA256

      990519661a04ffe23b87896ebeda1ea365eee686029998f37568c34d6987bd5b

    • SHA512

      f4e1e847d5d9df36ec51f48a1ee420da6e97e9b7fde8d8734e8b8e2ee5e2f253c4f07fcee57cd86c83680af7c77bb3da8ece39431fd7cf721f02212da187a0de

    • SSDEEP

      6144:lMVQL+S2kVowHrb9yo4dnx3pV083rCkeVsAl/PXI+gbrITb7+:yPkVokMXVNrVXO/P47brIz+

    Score
    10/10
    cybergatelammerpersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks