Overview

overview

10

Static

static

3

2a83432cb2...20.exe

windows7-x64

10

2a83432cb2...20.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2a83432cb29fb7dc1da346544971e420

  • Size

    620KB

  • Sample

    231225-s8prqsaehk

  • MD5

    2a83432cb29fb7dc1da346544971e420

  • SHA1

    a4b4b03d20eef8a01659b5dd6aa5f58c6fa741e0

  • SHA256

    dd76ec6f7d5c5c4b5530d1d83819d0976ca4d4538b0a543180c4b74f8da9db89

  • SHA512

    a5ed0b9bfc522b5c6ce83d06c5ac3dd960b7a6b9ee88e06b981132dd1eb95879ea6c382fcc3e73973567e27b20e2be3ec79e3ed071a57188c51db765cdb6bfaa

  • SSDEEP

    12288:AWOD3Y3R1whbHY+Dgd9VvlNU4rtH5IYWszq6LHMP:AnbDg5XU4rBnWs3Q

Score
10/10
cybergateslysbitchpersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

SlysBitch

C2

sly.fcuked.me.uk:2020

Mutex

Y0BB06QWE8BSVP

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    ma1lc0

Targets

    • Target

      2a83432cb29fb7dc1da346544971e420

    • Size

      620KB

    • MD5

      2a83432cb29fb7dc1da346544971e420

    • SHA1

      a4b4b03d20eef8a01659b5dd6aa5f58c6fa741e0

    • SHA256

      dd76ec6f7d5c5c4b5530d1d83819d0976ca4d4538b0a543180c4b74f8da9db89

    • SHA512

      a5ed0b9bfc522b5c6ce83d06c5ac3dd960b7a6b9ee88e06b981132dd1eb95879ea6c382fcc3e73973567e27b20e2be3ec79e3ed071a57188c51db765cdb6bfaa

    • SSDEEP

      12288:AWOD3Y3R1whbHY+Dgd9VvlNU4rtH5IYWszq6LHMP:AnbDg5XU4rBnWs3Q

    Score
    10/10
    cybergateslysbitchpersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks