cybergate | 8458012f61bae669fc5bd2d45b85bd3ebce982985b2c501f21c3f657fff9acad

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e89af522928ffbf03c30ad5d095fc0e.exe
Size

281KB
MD5

4e89af522928ffbf03c30ad5d095fc0e
SHA1

975fba25c0d6ef7157bbd68c4c37378141ea980d
SHA256

8458012f61bae669fc5bd2d45b85bd3ebce982985b2c501f21c3f657fff9acad
SHA512

b11633659630acc8a0b56a86a4ec5c9fd75a576272f096cdf6e51836b6467a9d28a92cfb5e1f7d8b288c399d7fa04a23f7d1c3ae4a2810e007943c0a4900f957
SSDEEP

6144:gScrLf4mp8D6WGc/YSlIipBReubLzeh7YMtMuIdLBPtdzWIsbEwu:xcoy78QSVnNyhscRIhfpWFbEX

Score

10^/10

cybergate mario cry persistence stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

mario cry

hilt000.no-ip.org:999

Mutex

R11UY8W0Q406Q1

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
explorer.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	4e89af522928ffbf03c30ad5d095fc0e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\explorer.exe"	4e89af522928ffbf03c30ad5d095fc0e.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	4e89af522928ffbf03c30ad5d095fc0e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\explorer.exe"	4e89af522928ffbf03c30ad5d095fc0e.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{VI8AX182-NKI7-0653-2XDQ-P5U6T47GHS72}	4e89af522928ffbf03c30ad5d095fc0e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{VI8AX182-NKI7-0653-2XDQ-P5U6T47GHS72}\StubPath = "C:\\Windows\\system32\\install\\explorer.exe Restart"	4e89af522928ffbf03c30ad5d095fc0e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\explorer.exe"	4e89af522928ffbf03c30ad5d095fc0e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\explorer.exe"	4e89af522928ffbf03c30ad5d095fc0e.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\explorer.exe	4e89af522928ffbf03c30ad5d095fc0e.exe
File opened for modification	C:\Windows\SysWOW64\install\explorer.exe	4e89af522928ffbf03c30ad5d095fc0e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1796	4e89af522928ffbf03c30ad5d095fc0e.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	4e89af522928ffbf03c30ad5d095fc0e.exe

C:\Users\Admin\AppData\Local\Temp\4e89af522928ffbf03c30ad5d095fc0e.exe
"C:\Users\Admin\AppData\Local\Temp\4e89af522928ffbf03c30ad5d095fc0e.exe"
1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-3-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download