Overview

overview

10

Static

static

3

36973428e3...74.exe

windows7-x64

10

36973428e3...74.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36973428e3d72f08e04817ff8d220574

  • Size

    559KB

  • Sample

    231225-xrlqzagdej

  • MD5

    36973428e3d72f08e04817ff8d220574

  • SHA1

    99a6b25f29cda9f0f369a881a9db1d308c870b9f

  • SHA256

    44fa8c09da4a363f30ebada45743c3d3e8d9e0a105940b7b3da6569754dd6f91

  • SHA512

    02869638d5ea3f5281b20ffed15647534c02e92605a512d32d92c5ee10fbc218a1da5195daefd1e423316f3c5e1edc30c9bf9cfc636d4fa0009dfe49c9ff23e2

  • SSDEEP

    12288:FnNo/JJP9fW9rwtf9QwIdKMpl1W2Yn6e9yWsXQqXsWdstV6B19xxrxFqb9sY:FNo/J3OkwKMpZE6hWUb

Score
10/10
cybergate0803persistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

0803

C2

shouky.no-ip.info:90

Mutex

XP5744Q2CO6VY3

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    lolilol

Targets

    • Target

      36973428e3d72f08e04817ff8d220574

    • Size

      559KB

    • MD5

      36973428e3d72f08e04817ff8d220574

    • SHA1

      99a6b25f29cda9f0f369a881a9db1d308c870b9f

    • SHA256

      44fa8c09da4a363f30ebada45743c3d3e8d9e0a105940b7b3da6569754dd6f91

    • SHA512

      02869638d5ea3f5281b20ffed15647534c02e92605a512d32d92c5ee10fbc218a1da5195daefd1e423316f3c5e1edc30c9bf9cfc636d4fa0009dfe49c9ff23e2

    • SSDEEP

      12288:FnNo/JJP9fW9rwtf9QwIdKMpl1W2Yn6e9yWsXQqXsWdstV6B19xxrxFqb9sY:FNo/J3OkwKMpZE6hWUb

    Score
    10/10
    cybergate0803persistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks