Overview

overview

10

Static

static

10

a5f1b1a528...fd.exe

windows7-x64

10

a5f1b1a528...fd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a5f1b1a528e2cf138ab966abb46069a01f8ba4f62009b91a5ef572e03c6595fd

  • Size

    280KB

  • Sample

    221206-3kjkxsec85

  • MD5

    d9cdac6b76c19890fa4425331194d053

  • SHA1

    93a4d30ef16af550827d7c5a0ab7267a8b6e6910

  • SHA256

    a5f1b1a528e2cf138ab966abb46069a01f8ba4f62009b91a5ef572e03c6595fd

  • SHA512

    791ef5a90c906d2128e099406789ed7cee2568139d70f5f7f1fbbe1adabfa5c2326d0b6f1aaba975a7f58e86b5735117849c5894d58750f04002a4f85efd8e6f

  • SSDEEP

    6144:O3LZcsxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPd5:KqeAtpVxagMU/plruchDofAP/

Score
10/10
cybergateslavepersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.02.0

Botnet

Slave

C2

twoshank.no-ip.info:82

Mutex

VC2XAYOA2N8X73

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    winlog.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    abc123

Targets

    • Target

      a5f1b1a528e2cf138ab966abb46069a01f8ba4f62009b91a5ef572e03c6595fd

    • Size

      280KB

    • MD5

      d9cdac6b76c19890fa4425331194d053

    • SHA1

      93a4d30ef16af550827d7c5a0ab7267a8b6e6910

    • SHA256

      a5f1b1a528e2cf138ab966abb46069a01f8ba4f62009b91a5ef572e03c6595fd

    • SHA512

      791ef5a90c906d2128e099406789ed7cee2568139d70f5f7f1fbbe1adabfa5c2326d0b6f1aaba975a7f58e86b5735117849c5894d58750f04002a4f85efd8e6f

    • SSDEEP

      6144:O3LZcsxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPd5:KqeAtpVxagMU/plruchDofAP/

    Score
    10/10
    cybergateslavepersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks