Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

38d87162c8...1a.exe

windows7-x64

10

38d87162c8...1a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    38d87162c893124ff43a581f3902141a

  • Size

    319KB

  • Sample

    231231-q8p2dsbbf8

  • MD5

    38d87162c893124ff43a581f3902141a

  • SHA1

    d3bf0a026ac6d6431c27feeeacf9e74f482f52bc

  • SHA256

    7ddb854cc5ae821203d506a964071ac0223f17bf6a49baa4fd1358a296d9e167

  • SHA512

    fb05aca2ade5bd08a33ba87619e18bc640d5742c0d02d949a6032870715d8e74504fdf41cf402eeaa1e8d15ac04c04d06ed2ad985b18552ef109fa12b3e0359b

  • SSDEEP

    6144:7ClfKz3VkWAWbssnPSe8f6nLFyQaxsmTdeAZ2QXG9asuL5xJagYWThmQH:wCjCWdYsnPV8ynByQmL2Q8aFLcgXT0g

Score
10/10
cybergateremotepersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.03.0

Botnet

remote

C2

62.221.133.218:30

Mutex

8DS88Y0D38V0L0

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

Targets

    • Target

      38d87162c893124ff43a581f3902141a

    • Size

      319KB

    • MD5

      38d87162c893124ff43a581f3902141a

    • SHA1

      d3bf0a026ac6d6431c27feeeacf9e74f482f52bc

    • SHA256

      7ddb854cc5ae821203d506a964071ac0223f17bf6a49baa4fd1358a296d9e167

    • SHA512

      fb05aca2ade5bd08a33ba87619e18bc640d5742c0d02d949a6032870715d8e74504fdf41cf402eeaa1e8d15ac04c04d06ed2ad985b18552ef109fa12b3e0359b

    • SSDEEP

      6144:7ClfKz3VkWAWbssnPSe8f6nLFyQaxsmTdeAZ2QXG9asuL5xJagYWThmQH:wCjCWdYsnPV8ynByQmL2Q8aFLcgXT0g

    Score
    10/10
    cybergateremotepersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks