Overview

overview

10

Static

static

3

4bc33668f1...06.exe

windows7-x64

10

4bc33668f1...06.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4bc33668f16dc27a3d8adc2654144f06

  • Size

    308KB

  • Sample

    240108-skjktacbgr

  • MD5

    4bc33668f16dc27a3d8adc2654144f06

  • SHA1

    e72370106fccca3836f6695e23b107bb0c7fd0d9

  • SHA256

    518405f9d746cf8871c05d11bc0e36c724c158c3145277dfe70f1e36768cb2a6

  • SHA512

    1baa9cfcf3ff09f6af5d7743f1a897685684091201750a5190e3faea36d98d9b5b832364d984ecef4f7b8c508fc5c6b3343a18944eb971d24f8d5e76f10e974d

  • SSDEEP

    6144:doyME3LVeaUm+XYU2ZXOgwPKgzPIpN2GgxysDgHlSOTVD7/2:h3Je2U2ZODIN7ONDWrhDb2

Score
10/10
cybergatespypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

spy

C2

lordnikon2012.zapto.org:3030

Mutex

SVA05X0NO081I6

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    update

  • install_file

    wininitx86.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    process denied (00034Fx3)error

  • message_box_title

    Error

  • password

    acidburn

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      4bc33668f16dc27a3d8adc2654144f06

    • Size

      308KB

    • MD5

      4bc33668f16dc27a3d8adc2654144f06

    • SHA1

      e72370106fccca3836f6695e23b107bb0c7fd0d9

    • SHA256

      518405f9d746cf8871c05d11bc0e36c724c158c3145277dfe70f1e36768cb2a6

    • SHA512

      1baa9cfcf3ff09f6af5d7743f1a897685684091201750a5190e3faea36d98d9b5b832364d984ecef4f7b8c508fc5c6b3343a18944eb971d24f8d5e76f10e974d

    • SSDEEP

      6144:doyME3LVeaUm+XYU2ZXOgwPKgzPIpN2GgxysDgHlSOTVD7/2:h3Je2U2ZODIN7ONDWrhDb2

    Score
    10/10
    cybergatespypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks