Overview

overview

10

Static

static

3

9d887661f4...57.exe

windows7-x64

10

9d887661f4...57.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d887661f41cd4578ad376328efc7d57

  • Size

    313KB

  • Sample

    240215-lbgxasdd6s

  • MD5

    9d887661f41cd4578ad376328efc7d57

  • SHA1

    c5dd333da4f71125f28c25487db7bffb90248d54

  • SHA256

    24f7d1e4647b80fae60bd975ca8bb5cf15d035b2a9c518adc21c0e7d7aa0caa4

  • SHA512

    0fd05822d8458ab5ba2f989057c39a910663553969ae27cc9504f140a3c9c13a0855cffe5c4d351dfe28a35bda8d4b4d655eed7589f145a609dda694cd110540

  • SSDEEP

    6144:2IOnpxvOJKGOB3xsOvHsiH8hERG9WcxeIESxSVbrb7syR:VYtOJJgxzvicG1xeI+b3om

Score
10/10
cybergatehackpersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Hack

C2

quickupload1.no-ip.org:5050

Mutex

S42TYDX7740URV

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    sysetm

  • install_file

    setting.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    typhoon

  • regkey_hkcu

    HKUC

  • regkey_hklm

    HKML

Targets

    • Target

      9d887661f41cd4578ad376328efc7d57

    • Size

      313KB

    • MD5

      9d887661f41cd4578ad376328efc7d57

    • SHA1

      c5dd333da4f71125f28c25487db7bffb90248d54

    • SHA256

      24f7d1e4647b80fae60bd975ca8bb5cf15d035b2a9c518adc21c0e7d7aa0caa4

    • SHA512

      0fd05822d8458ab5ba2f989057c39a910663553969ae27cc9504f140a3c9c13a0855cffe5c4d351dfe28a35bda8d4b4d655eed7589f145a609dda694cd110540

    • SSDEEP

      6144:2IOnpxvOJKGOB3xsOvHsiH8hERG9WcxeIESxSVbrb7syR:VYtOJJgxzvicG1xeI+b3om

    Score
    10/10
    cybergatehackpersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks