cybergate | 960e2b4e8a6cbd31a46f9dc73ac6c1d75246d5a7ec989eefd9bc20510f37e29c | Triage

Sharing

General

Target

960e2b4e8a6cbd31a46f9dc73ac6c1d75246d5a7ec989eefd9bc20510f37e29c
Size

506KB
Sample

221205-n46r8sgd42
MD5

4785b3f85473b490cad8ac943dc4a97c
SHA1

09f3cb78b935f8fff0cf3f89c01fbfa4f6232040
SHA256

960e2b4e8a6cbd31a46f9dc73ac6c1d75246d5a7ec989eefd9bc20510f37e29c
SHA512

8b1c30df8e88d6e97d3a2450a529073e796d041538ad0c8858a9dc879191029338a00048db83273ebf78b49ced42ac85b877ef73ae5bbc596654e9ad82d99a84
SSDEEP

12288:fjJjW7ddHzOVRMTUL25heoOjKt+Z6A15HPb:UHzgAUIf+Z6Y5vb

Score

10^/10

cybergate bot stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.13.1

Botnet

Bot

C2

hexrut.sytes.net:82

Mutex

SCS3303XA8MX11

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
system32
install_file
igfxpers.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
890527q
regkey_hkcu
Persistence
regkey_hklm
Persistence

Targets

- Target
  
  960e2b4e8a6cbd31a46f9dc73ac6c1d75246d5a7ec989eefd9bc20510f37e29c
- Size
  
  506KB
- MD5
  
  4785b3f85473b490cad8ac943dc4a97c
- SHA1
  
  09f3cb78b935f8fff0cf3f89c01fbfa4f6232040
- SHA256
  
  960e2b4e8a6cbd31a46f9dc73ac6c1d75246d5a7ec989eefd9bc20510f37e29c
- SHA512
  
  8b1c30df8e88d6e97d3a2450a529073e796d041538ad0c8858a9dc879191029338a00048db83273ebf78b49ced42ac85b877ef73ae5bbc596654e9ad82d99a84
- SSDEEP
  
  12288:fjJjW7ddHzOVRMTUL25heoOjKt+Z6A15HPb:UHzgAUIf+Z6Y5vb
Score

10^/10

cybergate bot stealer trojan
- CyberGate, Rebhip
  CyberGate is a lightweight remote administration tool with a wide array of functionalities.
  trojan stealer cybergate
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

cybergatebotstealertrojan

behavioral2