Overview

overview

10

Static

static

10

ABO.exe

windows7-x64

8

ABO.exe

windows10-2004-x64

8

ABO.exe

windows7-x64

8

ABO.exe

windows10-2004-x64

10

Adobe.exe

windows7-x64

8

Adobe.exe

windows10-2004-x64

10

CGserver.exe

windows7-x64

10

CGserver.exe

windows10-2004-x64

10

COON.exe

windows7-x64

10

COON.exe

windows10-2004-x64

8

FFA.exe

windows7-x64

10

FFA.exe

windows10-2004-x64

8

FIle Rustyz bot.exe

windows7-x64

8

FIle Rustyz bot.exe

windows10-2004-x64

8

FrostBot v1.exe

windows7-x64

10

FrostBot v1.exe

windows10-2004-x64

10

Google.exe

windows7-x64

10

Google.exe

windows10-2004-x64

10

MORPH_9359...79.exe

windows7-x64

3

MORPH_9359...79.exe

windows10-2004-x64

3

Mycrypt.exe

windows7-x64

8

Mycrypt.exe

windows10-2004-x64

10

PortChecker.exe

windows7-x64

8

PortChecker.exe

windows10-2004-x64

10

R.exe

windows7-x64

10

R.exe

windows10-2004-x64

10

RSBOT.exe

windows7-x64

RSBOT.exe

windows10-2004-x64

Rustyz.exe

windows7-x64

8

Rustyz.exe

windows10-2004-x64

10

Rustyzzbot.exe

windows7-x64

8

Rustyzzbot.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4da9865240bd15b59025e9adcce95041

  • Size

    3.6MB

  • MD5

    4da9865240bd15b59025e9adcce95041

  • SHA1

    aab7bae83afe0211b7bf41628f44e1edf699d28c

  • SHA256

    b2b1f374822e760b574cff680d989d0f229bdaf9029acacb2449162b92bbc16b

  • SHA512

    3dc7df2d520eddc23e98337537a110ed5969222cdff76d5c7e83cffbbbf987431e09df91781789020019c32981c509e36535a74bc1913a7f5ac16359c6810ef9

  • SSDEEP

    98304:GKZWKZc2golKZ8L2djKbqFYNn1bPoxMk5Aq1boWoN7:GKMKu2DlKVWbqNxpoN7

Score
10/10
remotecyberupxcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

remote

C2

fearrusty.no-ip.info:82

Mutex

0DO30B5W0TAO3W

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    Facebook.com

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cyber

C2

op9.no-ip.biz:100

Mutex

H6Y643Q6J85D62

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    iTunes.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

Extracted

Family

cybergate

Version

v1.02.0

Botnet

remote

C2

fearrusty.no-ip.info:82

127.0.0.1:999

op9.no-ip.biz:82
Mutex

L0J8X1U03TC2TJ

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    csrss.exe

  • install_dir

    install

  • install_file

    iTunes.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    12345

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 23 IoCs

    Checks for missing Authenticode signature.

Files

  • 4da9865240bd15b59025e9adcce95041
    .zip
  • ABO.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ABO.exe.1
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Adobe.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • CGserver.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • COON.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • FFA.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • FIle Rustyz bot.exe
    .exe windows:4 windows x86 arch:x86

    133a67ce7c302fe6d3a50bddb5e48784


    Headers

    Imports

    Sections

  • FrostBot v1.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Google.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • MORPH_93594C2E8879.EXE
    .exe windows:5 windows x86 arch:x86

    cfe8b288af4f74a254317ab56fefbf8f


    Headers

    Imports

    Sections

  • Mycrypt.exe
    .exe windows:4 windows x86 arch:x86

    9fe566196ecc9d3547da0b2fcf1ad8b1


    Headers

    Imports

    Sections

  • PortChecker.exe
    .exe windows:4 windows x86 arch:x86

    a0e88d9ed1057226fa0a6647378d326e


    Headers

    Imports

    Sections

  • R.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • RSBOT.exe
  • Rustyz.exe
    .exe windows:4 windows x86 arch:x86

    a0e88d9ed1057226fa0a6647378d326e


    Headers

    Imports

    Sections

  • Rustyzzbot.exe
    .exe windows:4 windows x86 arch:x86

    a0e88d9ed1057226fa0a6647378d326e


    Headers

    Imports

    Sections

  • Uncrypted.exe
    .exe windows:4 windows x86 arch:x86

    a0e88d9ed1057226fa0a6647378d326e


    Headers

    Imports

    Sections

  • gabberoneshay.exe
    .exe windows:4 windows x86 arch:x86

    a0e88d9ed1057226fa0a6647378d326e


    Headers

    Imports

    Sections

  • server.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • url.txt
  • xXxRay.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections