cybergate | ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2

General

Target

ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
Size

400KB
MD5

13693ca45e8932cb33703e42a16c7790
SHA1

e1264599e0341889523ec161e25cdc5efaccc577
SHA256

ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2
SHA512

87ecefcd543b8ec59e9cbadec9ae72403631d39a4b403a895f49916ea8b4d2e705c22b408c3e7ad1fce928a0435827903911080270b3dbd805e59e0950e2ce56
SSDEEP

6144:DYuREg+KzpmpCJKhO81+eQSQXuECLkDzBa+QxWjEi8BH/xoMHQugveLdxe:UuD+BL1lQNJCLkDtasjEi8BH/xeBeQ

Score

10^/10

cybergate infected stealer trojan

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

Infected

C2

goforit.no-ip.biz:7410

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
DATAF
install_file
msrcv.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
goa

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Suspicious use of SetThreadContext 1 IoCs

Processes:

ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

description	pid	process	target process
PID 4540 set thread context of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

pid	process
4924	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
4924	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

pid process

4540 ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

pid	process
4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

description	pid	process	target process
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
PID 4540 wrote to memory of 4924	4540	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe	ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
"C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540

C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4540-132-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4540-134-0x00000000004B0000-0x00000000004C0000-memory.dmp

Filesize
64KB

Download
memory/4540-138-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4924-135-0x0000000000000000-mapping.dmp

Download
memory/4924-136-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4924-137-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4924-139-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4924-140-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4924-141-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads