Overview

overview

10

Static

static

10

f86d8d41a9...05.exe

windows7-x64

8

f86d8d41a9...05.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f86d8d41a9d9ed74eedfb175b763e8dbef598052bbf7cba1aef9a596d4fa9405

  • Size

    194KB

  • Sample

    221205-1wyswaed2x

  • MD5

    92286040373b233a6f611973eada0b00

  • SHA1

    be3af3dbf8de5495662d47ae1f61060d817612ac

  • SHA256

    f86d8d41a9d9ed74eedfb175b763e8dbef598052bbf7cba1aef9a596d4fa9405

  • SHA512

    aeee2d9e86199276ebce66e62d67140b173756d6f501c2106cbf7702d8289877bb347ec4200925d4f07a8089cba811a8235f69c3942078db927adb3573f55497

  • SSDEEP

    3072:RiWmAlxYYXbeItPPjtq0svSa51sH4fUlknOF1d2sjca4vy:PxYYXbeICYa51ilkODd2sjh4vy

Score
10/10
cybergater'séïïßö÷»úpersistenceupx

Malware Config

Extracted

Family

cybergate

Version

2.1

Botnet

R'sÉÏÏßÖ÷»ú

C2

127.0.0.1:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    ÕâÊÇÀ´×ÔÓÚRover12421µÄÎʺò£¡

  • message_box_title

    Rover12421µÄÎʺò

  • password

    abcd1234

Targets

    • Target

      f86d8d41a9d9ed74eedfb175b763e8dbef598052bbf7cba1aef9a596d4fa9405

    • Size

      194KB

    • MD5

      92286040373b233a6f611973eada0b00

    • SHA1

      be3af3dbf8de5495662d47ae1f61060d817612ac

    • SHA256

      f86d8d41a9d9ed74eedfb175b763e8dbef598052bbf7cba1aef9a596d4fa9405

    • SHA512

      aeee2d9e86199276ebce66e62d67140b173756d6f501c2106cbf7702d8289877bb347ec4200925d4f07a8089cba811a8235f69c3942078db927adb3573f55497

    • SSDEEP

      3072:RiWmAlxYYXbeItPPjtq0svSa51sH4fUlknOF1d2sjca4vy:PxYYXbeICYa51ilkODd2sjh4vy

    Score
    8/10
    persistenceupx

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks