Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4123bf29f1...09.exe

windows7-x64

10

4123bf29f1...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4123bf29f1a36f8940272dfcfb9ab409

  • Size

    324KB

  • Sample

    240104-r52fpaabfq

  • MD5

    4123bf29f1a36f8940272dfcfb9ab409

  • SHA1

    a2657ed954e37a6e39585c5e938fd610e9b71137

  • SHA256

    de2f10468d57b9c055a4a4e829c09862f58707223042c80c79c5d17dd7cc30e6

  • SHA512

    f108e8a48b2073624262015c12b6d1ef2d45fe5f1bd7496e20bbb7137eb59414fa61e6319c62c3a5d5cb93377e105cfeb796810c16ec66c5945e30e438c546e9

  • SSDEEP

    6144:qhmTH1EWuzEwi9fYtR7Rfvb0JOPScVeb+jUtV6v6/aO5R:omH1EWuwtfYrRXb7VVeqAsSiyR

Score
10/10
cybergateremotepersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

remote

C2

tim0.dyndns.org:81

tim0.dyndns.org:82
Mutex

N65I4020CC0882

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    .//

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    QWERTZ

Targets

    • Target

      4123bf29f1a36f8940272dfcfb9ab409

    • Size

      324KB

    • MD5

      4123bf29f1a36f8940272dfcfb9ab409

    • SHA1

      a2657ed954e37a6e39585c5e938fd610e9b71137

    • SHA256

      de2f10468d57b9c055a4a4e829c09862f58707223042c80c79c5d17dd7cc30e6

    • SHA512

      f108e8a48b2073624262015c12b6d1ef2d45fe5f1bd7496e20bbb7137eb59414fa61e6319c62c3a5d5cb93377e105cfeb796810c16ec66c5945e30e438c546e9

    • SSDEEP

      6144:qhmTH1EWuzEwi9fYtR7Rfvb0JOPScVeb+jUtV6v6/aO5R:omH1EWuwtfYrRXb7VVeqAsSiyR

    Score
    10/10
    cybergateremotepersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks