Overview

overview

10

Static

static

10

ea03e4ee84...72.exe

windows7-x64

10

ea03e4ee84...72.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ea03e4ee84feddbbd8533781f6817fb05f21200dfb7afe3f34f85f5d26eb9372

  • Size

    578KB

  • Sample

    221204-dsqa1abh67

  • MD5

    8ca846aee82b2958ad43c40a54816f77

  • SHA1

    4171e5010efeb7c38d8df957c80acd4d70ff2167

  • SHA256

    ea03e4ee84feddbbd8533781f6817fb05f21200dfb7afe3f34f85f5d26eb9372

  • SHA512

    ea3ebdf82b3b53b27e8d07802d75489be796ee053f3a127c4cf28766ebdab6cb35f87791806050ac16d00e92d79479a3c3fb57ff6f4171f94c28b518d1c5cd11

  • SSDEEP

    12288:dEa0cD66389+7Hs9+7Hs9+7HxZ2zkPaCxIT:dEa0p9+js9+js9+jxZOkl2

Score
10/10
cybergateöííépersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

back2life.no-ip.info:300

biforst.dyndns.info:400
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    system pwor.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    pless restart

  • message_box_title

    Error

  • password

    06

Targets

    • Target

      ea03e4ee84feddbbd8533781f6817fb05f21200dfb7afe3f34f85f5d26eb9372

    • Size

      578KB

    • MD5

      8ca846aee82b2958ad43c40a54816f77

    • SHA1

      4171e5010efeb7c38d8df957c80acd4d70ff2167

    • SHA256

      ea03e4ee84feddbbd8533781f6817fb05f21200dfb7afe3f34f85f5d26eb9372

    • SHA512

      ea3ebdf82b3b53b27e8d07802d75489be796ee053f3a127c4cf28766ebdab6cb35f87791806050ac16d00e92d79479a3c3fb57ff6f4171f94c28b518d1c5cd11

    • SSDEEP

      12288:dEa0cD66389+7Hs9+7Hs9+7HxZ2zkPaCxIT:dEa0p9+js9+js9+jxZOkl2

    Score
    10/10
    cybergateöííépersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks