Overview

overview

10

Static

static

9498de5a2e...a5.exe

windows7-x64

10

9498de5a2e...a5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9498de5a2efcc4ded594c9f858308aa2f09a23ea49e31d309b54059b8f8112a5

  • Size

    327KB

  • Sample

    221205-pa3zxsgh86

  • MD5

    0d2478e9ce7bbd1791aac10d37e4ced0

  • SHA1

    0356aeffe6ce2a270a8fd845df0080f686404a15

  • SHA256

    9498de5a2efcc4ded594c9f858308aa2f09a23ea49e31d309b54059b8f8112a5

  • SHA512

    9914c9304067def845052fb0f5443fdfb458a3405633f8e2a9fd2860edf57a04e04b446dec307228d548959ede527d04974ab478456b31b91e7cbb71ce1cfd23

  • SSDEEP

    6144:Y5GWFJFFuqly0X+lmTxi1/vWrpyfSMnQSEqQqTWfXJNmf:YIAzFjulmS/vWrpyFQS0qTWf6f

Score
10/10
cybergate2persistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

2

C2

84.120.59.104:4222

90.162.61.13:4332

84.120.55.87:4112

90.162.61.78:4442

leskieroatodos.no-ip.org:4552
Mutex

4VEUT705FC0A46

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    acrobat

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    borito1010

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      9498de5a2efcc4ded594c9f858308aa2f09a23ea49e31d309b54059b8f8112a5

    • Size

      327KB

    • MD5

      0d2478e9ce7bbd1791aac10d37e4ced0

    • SHA1

      0356aeffe6ce2a270a8fd845df0080f686404a15

    • SHA256

      9498de5a2efcc4ded594c9f858308aa2f09a23ea49e31d309b54059b8f8112a5

    • SHA512

      9914c9304067def845052fb0f5443fdfb458a3405633f8e2a9fd2860edf57a04e04b446dec307228d548959ede527d04974ab478456b31b91e7cbb71ce1cfd23

    • SSDEEP

      6144:Y5GWFJFFuqly0X+lmTxi1/vWrpyfSMnQSEqQqTWfXJNmf:YIAzFjulmS/vWrpyFQS0qTWf6f

    Score
    10/10
    cybergate2persistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks