Overview

overview

10

Static

static

3

57a45a0952...0a.exe

windows7-x64

10

57a45a0952...0a.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    57a45a0952704f4d93068068b535b90a

  • Size

    341KB

  • Sample

    240113-bz98msach3

  • MD5

    57a45a0952704f4d93068068b535b90a

  • SHA1

    e5d0d0f2b43047e9316e5292c1ff82336499308c

  • SHA256

    76ba569dfba4350450eb02059c76af72c8b35fd494b2391327a1db2b7e3fe6d3

  • SHA512

    2a50a648df9c2be9e01ff7d7bbd164e6188de46efdaef05b4a3e6a962c75d2e8a87c516f4e1037066805df3610f0d02d1c907a048620173244c5254d3bcf85df

  • SSDEEP

    6144:/CDaGssj5sKXWXg2HQ5KU4n3V9vSb+RFn43vLhajKTcUaz6Nt4YC/S/:/YJssVjir29YjTz2eU/

Score
10/10
cybergatevítimapersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

127.0.0.1:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Targets

    • Target

      57a45a0952704f4d93068068b535b90a

    • Size

      341KB

    • MD5

      57a45a0952704f4d93068068b535b90a

    • SHA1

      e5d0d0f2b43047e9316e5292c1ff82336499308c

    • SHA256

      76ba569dfba4350450eb02059c76af72c8b35fd494b2391327a1db2b7e3fe6d3

    • SHA512

      2a50a648df9c2be9e01ff7d7bbd164e6188de46efdaef05b4a3e6a962c75d2e8a87c516f4e1037066805df3610f0d02d1c907a048620173244c5254d3bcf85df

    • SSDEEP

      6144:/CDaGssj5sKXWXg2HQ5KU4n3V9vSb+RFn43vLhajKTcUaz6Nt4YC/S/:/YJssVjir29YjTz2eU/

    Score
    10/10
    cybergatevítimapersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks