General

  • Target

    961e8ab6b077af228b781e0feb4c9ca1

  • Size

    792KB

  • Sample

    240212-dx1yascf4z

  • MD5

    961e8ab6b077af228b781e0feb4c9ca1

  • SHA1

    900d04ec6caea24bcfb5b2f6ca739c973f03c4d6

  • SHA256

    441f2df30d6ba3d0127977bbe0d58ffdb19d822878003012e8fe7a4da99ccc93

  • SHA512

    3c139b4c08eea880d2fdb3f98a221af7cf0f2787c72631ee8bd89d5a2f06f11b6fb6fc2e4a53b4618f11c20ea2d58a5d6510119c0110f9f5b9991627d09cf319

  • SSDEEP

    12288:GVhshwpAGWFgOLhT9bZB4DJVpHqe6rpA7pdf8HkbX8Ar2ABy4GFm:GbpTWFRHbzuVarpodUHOsm26y4GFm

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

q

C2

svchost-net.serveblog.net:45

178.162.47.28:59065

Mutex

VHB8VONWP2X025

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    system32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      961e8ab6b077af228b781e0feb4c9ca1

    • Size

      792KB

    • MD5

      961e8ab6b077af228b781e0feb4c9ca1

    • SHA1

      900d04ec6caea24bcfb5b2f6ca739c973f03c4d6

    • SHA256

      441f2df30d6ba3d0127977bbe0d58ffdb19d822878003012e8fe7a4da99ccc93

    • SHA512

      3c139b4c08eea880d2fdb3f98a221af7cf0f2787c72631ee8bd89d5a2f06f11b6fb6fc2e4a53b4618f11c20ea2d58a5d6510119c0110f9f5b9991627d09cf319

    • SSDEEP

      12288:GVhshwpAGWFgOLhT9bZB4DJVpHqe6rpA7pdf8HkbX8Ar2ABy4GFm:GbpTWFRHbzuVarpodUHOsm26y4GFm

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Modifies Installed Components in the registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks