General

  • Target

    8f2f4a447404dac29dd1c6305c32b0f1ea8646bd395d9ba554bf24524abb0e95

  • Size

    587KB

  • Sample

    230129-26wxpsgg82

  • MD5

    5c7310b5379214dc6f87f6a81a69d569

  • SHA1

    6bf707b4117c9bdef6dbf86bbcee77f05c855869

  • SHA256

    8f2f4a447404dac29dd1c6305c32b0f1ea8646bd395d9ba554bf24524abb0e95

  • SHA512

    b3386caba3959c7f6a0bb362a11e261252ba98ed5ac601f1fe7991f28af60d668d48feb4b99bfab0bfdb53bbadf69a4984fc70f4133d5c8aedcb0e05515584c7

  • SSDEEP

    12288:0RIM7C5ZF2zW86Ng8EniFIWJpoJ5sNCmkQnlFet9RP0dSQ3A:0RV4brNZlEWS

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

securenetworks.no-ip.org:8088

Mutex

F0003B74F12VI4

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      8f2f4a447404dac29dd1c6305c32b0f1ea8646bd395d9ba554bf24524abb0e95

    • Size

      587KB

    • MD5

      5c7310b5379214dc6f87f6a81a69d569

    • SHA1

      6bf707b4117c9bdef6dbf86bbcee77f05c855869

    • SHA256

      8f2f4a447404dac29dd1c6305c32b0f1ea8646bd395d9ba554bf24524abb0e95

    • SHA512

      b3386caba3959c7f6a0bb362a11e261252ba98ed5ac601f1fe7991f28af60d668d48feb4b99bfab0bfdb53bbadf69a4984fc70f4133d5c8aedcb0e05515584c7

    • SSDEEP

      12288:0RIM7C5ZF2zW86Ng8EniFIWJpoJ5sNCmkQnlFet9RP0dSQ3A:0RV4brNZlEWS

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks