General

  • Target

    b2b8544d38861379e85cd5c3eb0c0d5e13b34f025fdd81d3a56fb1566545267e

  • Size

    324KB

  • Sample

    230129-l1tx6abh4z

  • MD5

    eec2c724ab0a193e3b0ff9ab323b5775

  • SHA1

    a04f87b90f533271491a73279a71db0d12ac9dfa

  • SHA256

    b2b8544d38861379e85cd5c3eb0c0d5e13b34f025fdd81d3a56fb1566545267e

  • SHA512

    6b87e6c0640f1d96298863d01ab22580ba0a3d67df569f3ec3a06b2770ff45885e049606d5eab3c0720d767f4cdb11234c4db076d2c13c3ad8ac808922308f43

  • SSDEEP

    6144:o/nOu4hTo9VtYtBqc6uDe1V6y5qHKBJQX8irqtgArq:jHhM9VEqqDY1zQX8i3Am

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

aaaa1234.no-ip.org:1700

Mutex

DMK32010Y88744

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    system.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1234

Targets

    • Target

      b2b8544d38861379e85cd5c3eb0c0d5e13b34f025fdd81d3a56fb1566545267e

    • Size

      324KB

    • MD5

      eec2c724ab0a193e3b0ff9ab323b5775

    • SHA1

      a04f87b90f533271491a73279a71db0d12ac9dfa

    • SHA256

      b2b8544d38861379e85cd5c3eb0c0d5e13b34f025fdd81d3a56fb1566545267e

    • SHA512

      6b87e6c0640f1d96298863d01ab22580ba0a3d67df569f3ec3a06b2770ff45885e049606d5eab3c0720d767f4cdb11234c4db076d2c13c3ad8ac808922308f43

    • SSDEEP

      6144:o/nOu4hTo9VtYtBqc6uDe1V6y5qHKBJQX8irqtgArq:jHhM9VEqqDY1zQX8i3Am

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks