General

  • Target

    ca536a3bbf99daaa48b522a00387cdf5

  • Size

    796KB

  • Sample

    240315-dmjw2aha78

  • MD5

    ca536a3bbf99daaa48b522a00387cdf5

  • SHA1

    9ef68dad07b56dde9179d357785f019b70e7edbe

  • SHA256

    446e6c171688a78b60e7e918f7ab795574aac7bc94a0c393676f3d96db26eda8

  • SHA512

    fce95783de84c18a66e3947c522d1cab3100ddd496da8ba11f3d7f0c436525efa650c2fcf323d2b77b37e382a0df130028ce7466d932a361bbfaede90449de8d

  • SSDEEP

    24576:JKfrAgjmcsZ/wPK+29WoERWi5FKKieZ+U8V4V:kfh+Z/wy+29WoERF5FKKieQU8Vu

Malware Config

Extracted

Family

cybergate

Version

v1.01.8

Botnet

uphero

C2

uphero.no-ip.info:443

Mutex

CyberGate1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      ca536a3bbf99daaa48b522a00387cdf5

    • Size

      796KB

    • MD5

      ca536a3bbf99daaa48b522a00387cdf5

    • SHA1

      9ef68dad07b56dde9179d357785f019b70e7edbe

    • SHA256

      446e6c171688a78b60e7e918f7ab795574aac7bc94a0c393676f3d96db26eda8

    • SHA512

      fce95783de84c18a66e3947c522d1cab3100ddd496da8ba11f3d7f0c436525efa650c2fcf323d2b77b37e382a0df130028ce7466d932a361bbfaede90449de8d

    • SSDEEP

      24576:JKfrAgjmcsZ/wPK+29WoERWi5FKKieZ+U8V4V:kfh+Z/wy+29WoERF5FKKieQU8Vu

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks