Overview

overview

10

Static

static

960e2b4e8a...9c.exe

windows7-x64

10

960e2b4e8a...9c.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    31s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2022 11:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    960e2b4e8a6cbd31a46f9dc73ac6c1d75246d5a7ec989eefd9bc20510f37e29c.exe

  • Size

    506KB

  • MD5

    4785b3f85473b490cad8ac943dc4a97c

  • SHA1

    09f3cb78b935f8fff0cf3f89c01fbfa4f6232040

  • SHA256

    960e2b4e8a6cbd31a46f9dc73ac6c1d75246d5a7ec989eefd9bc20510f37e29c

  • SHA512

    8b1c30df8e88d6e97d3a2450a529073e796d041538ad0c8858a9dc879191029338a00048db83273ebf78b49ced42ac85b877ef73ae5bbc596654e9ad82d99a84

  • SSDEEP

    12288:fjJjW7ddHzOVRMTUL25heoOjKt+Z6A15HPb:UHzgAUIf+Z6Y5vb

Score
10/10
cybergatebotstealertrojan

Malware Config

Extracted

Family

cybergate

Version

v1.13.1

Botnet

Bot

C2

hexrut.sytes.net:82

Mutex

SCS3303XA8MX11

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system32

  • install_file

    igfxpers.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    890527q

  • regkey_hkcu

    Persistence

  • regkey_hklm

    Persistence

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

Processes

  • C:\Users\Admin\AppData\Local\Temp\960e2b4e8a6cbd31a46f9dc73ac6c1d75246d5a7ec989eefd9bc20510f37e29c.exe
    "C:\Users\Admin\AppData\Local\Temp\960e2b4e8a6cbd31a46f9dc73ac6c1d75246d5a7ec989eefd9bc20510f37e29c.exe"
    1⤵
      PID:1088

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1088-54-0x0000000000780000-0x0000000000888000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1088-55-0x0000000000400000-0x0000000000508000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1088-56-0x0000000000400000-0x0000000000508000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1088-57-0x0000000000400000-0x0000000000508000-memory.dmp
      Filesize

      1.0MB

      Download