Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

1533c81b22...16.exe

windows7-x64

10

1533c81b22...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1533c81b22c38bf7f7e16ac587c91116

  • Size

    604KB

  • Sample

    231224-18h8ysdec4

  • MD5

    1533c81b22c38bf7f7e16ac587c91116

  • SHA1

    ab97ab39e34b44f06bba7f4c7a68df83742d4708

  • SHA256

    3d74cfe784a7cfebb08ea78ff2c67b673833c3c710931d663444c645d9a5ba48

  • SHA512

    a96110db4dde048b95314a1ac653c8c31bff40d96a970dcd8ed016a8772b17a5bc8ad0b3904ea31cb5219b243a4c0512990fb7283444c1862ee7fe1d940393c5

  • SSDEEP

    12288:D3DOrVS2k0CIxhNm/74WLap2Q4SAqz2BBx5pD1aqA5nNfmHUv7+0N1R7:D3yrVW09NmDM2/c2BjzD1uNe0vaKR7

Score
10/10
cybergatekingpersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

KinG

C2

7osam.no-ip.biz:1604

Mutex

07FG30XG66S10O

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456789

  • regkey_hkcu

    Cyber

  • regkey_hklm

    Cyber

Targets

    • Target

      1533c81b22c38bf7f7e16ac587c91116

    • Size

      604KB

    • MD5

      1533c81b22c38bf7f7e16ac587c91116

    • SHA1

      ab97ab39e34b44f06bba7f4c7a68df83742d4708

    • SHA256

      3d74cfe784a7cfebb08ea78ff2c67b673833c3c710931d663444c645d9a5ba48

    • SHA512

      a96110db4dde048b95314a1ac653c8c31bff40d96a970dcd8ed016a8772b17a5bc8ad0b3904ea31cb5219b243a4c0512990fb7283444c1862ee7fe1d940393c5

    • SSDEEP

      12288:D3DOrVS2k0CIxhNm/74WLap2Q4SAqz2BBx5pD1aqA5nNfmHUv7+0N1R7:D3yrVW09NmDM2/c2BjzD1uNe0vaKR7

    Score
    10/10
    cybergatekingpersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks