General

  • Target

    cfeecbc1b9bdbe6d338154cafa4fb8fe

  • Size

    301KB

  • Sample

    240317-e5t1dsef8x

  • MD5

    cfeecbc1b9bdbe6d338154cafa4fb8fe

  • SHA1

    3fae72e54d49e071833727e0e41b51e101b8b4e7

  • SHA256

    de991a9b13e19f63bbabad2cda1958f568b057c53412324e3db7369d92434e5e

  • SHA512

    45777d2cd360f473c531cb35641e70d0ca6ba4245a24a6c4560e4b23aa0e546d107fda00a43b877465d8ef4024c5df07b7035f3bc815605a6ce3bad773e784f6

  • SSDEEP

    6144:tmcD66R7z5JGmrpQsK3RD2u270jupCJsCxC:4cD664Z2zkPaCx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

sonson

C2

bazooka07.no-ip.biz:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    NVIDIA

  • install_file

    Driver.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      cfeecbc1b9bdbe6d338154cafa4fb8fe

    • Size

      301KB

    • MD5

      cfeecbc1b9bdbe6d338154cafa4fb8fe

    • SHA1

      3fae72e54d49e071833727e0e41b51e101b8b4e7

    • SHA256

      de991a9b13e19f63bbabad2cda1958f568b057c53412324e3db7369d92434e5e

    • SHA512

      45777d2cd360f473c531cb35641e70d0ca6ba4245a24a6c4560e4b23aa0e546d107fda00a43b877465d8ef4024c5df07b7035f3bc815605a6ce3bad773e784f6

    • SSDEEP

      6144:tmcD66R7z5JGmrpQsK3RD2u270jupCJsCxC:4cD664Z2zkPaCx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks