Overview

overview

10

Static

static

3

384beedce7...fe.exe

windows7-x64

10

384beedce7...fe.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    384beedce7d319901771696a69773afe.exe

  • Size

    392KB

  • Sample

    240110-ybcc2afagl

  • MD5

    384beedce7d319901771696a69773afe

  • SHA1

    58a56008bcbc46f0d8db34f2ebe57e922120a233

  • SHA256

    17a500795905d40798c4ee33ce0d95d0c67f995bc9993ae032010d052020292c

  • SHA512

    e371383d7f261cdade1af536397141ed061cef354f5472a4894216a528a1fc713daeefa69a61474b67b31212d0cbb06d0b88e65fd58a7d28c59b3a7aaa709cdb

  • SSDEEP

    6144:C1xkujK26n0JpLteqa095Kyif+b3alW4LWmIS8khs3XvW3Kpk4xqNsy8p1SVpXhg:+X60p7D7K1mb3FCMW3KnxLpclC

Score
10/10
cybergatevítimapersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

aaa.zapto.org:82

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      384beedce7d319901771696a69773afe.exe

    • Size

      392KB

    • MD5

      384beedce7d319901771696a69773afe

    • SHA1

      58a56008bcbc46f0d8db34f2ebe57e922120a233

    • SHA256

      17a500795905d40798c4ee33ce0d95d0c67f995bc9993ae032010d052020292c

    • SHA512

      e371383d7f261cdade1af536397141ed061cef354f5472a4894216a528a1fc713daeefa69a61474b67b31212d0cbb06d0b88e65fd58a7d28c59b3a7aaa709cdb

    • SSDEEP

      6144:C1xkujK26n0JpLteqa095Kyif+b3alW4LWmIS8khs3XvW3Kpk4xqNsy8p1SVpXhg:+X60p7D7K1mb3FCMW3KnxLpclC

    Score
    10/10
    cybergatevítimapersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks