Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9eae7ed651aa81ed072393177622ff8b4a9d15f313e0518ee3b54153e7fd78ed

  • Size

    300KB

  • Sample

    221206-m49cpaef5z

  • MD5

    6d12c13bdba139a49086dd92d9de5cc5

  • SHA1

    2f4d89f325ff614941a5ce408280e4c71b3fe1a0

  • SHA256

    9eae7ed651aa81ed072393177622ff8b4a9d15f313e0518ee3b54153e7fd78ed

  • SHA512

    0bddf439837fe362a3f8cd22e0be023e45214a188ecf3c3c54cc9a61a5a080e55594309ec2976639c4649b284b14469d6e55d52ec127f338cf1e67b8f4fee779

  • SSDEEP

    6144:4SZd4YmAzx1c29KNG/Pl879l3Tw/7fnEy+JB9RDse/XZ:4UaY7XcmYG3WJm7fnH+nge/XZ

Malware Config

Extracted

Family

cybergate

Version

v1.05.1

Botnet

omer

C2

romeoooo.no-ip.biz:82

Mutex

653HAW26XJ4465

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    runddl

  • install_file

    runddl.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    420

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      9eae7ed651aa81ed072393177622ff8b4a9d15f313e0518ee3b54153e7fd78ed

    • Size

      300KB

    • MD5

      6d12c13bdba139a49086dd92d9de5cc5

    • SHA1

      2f4d89f325ff614941a5ce408280e4c71b3fe1a0

    • SHA256

      9eae7ed651aa81ed072393177622ff8b4a9d15f313e0518ee3b54153e7fd78ed

    • SHA512

      0bddf439837fe362a3f8cd22e0be023e45214a188ecf3c3c54cc9a61a5a080e55594309ec2976639c4649b284b14469d6e55d52ec127f338cf1e67b8f4fee779

    • SSDEEP

      6144:4SZd4YmAzx1c29KNG/Pl879l3Tw/7fnEy+JB9RDse/XZ:4UaY7XcmYG3WJm7fnH+nge/XZ

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks