General

  • Target

    d007b0aeb3683085efe2fef470362a71

  • Size

    444KB

  • Sample

    240317-f12ecafa84

  • MD5

    d007b0aeb3683085efe2fef470362a71

  • SHA1

    132eaa1b3e1196dc2af4a7398a341ebe7afc9a45

  • SHA256

    e72d7929b1390bac9b2211e0bad4e15b9f90d66929ff45af164ab3da0d73edb1

  • SHA512

    93c1a6665c4fb3cd4b8dcab3267a6cb2f43805f58d2a6451e4d87f3843180e5243ca51be17660a43907c3cfa8cd7ae108055200372c16ae4754c108920ad8008

  • SSDEEP

    6144:Ox9gTRkwQKetnrc4K2YLtsOfXXjXTpcI0YI7KIpbfklXhlVDX8mVdRQ/vqkg1gE6:Ox9gl8tnw4KDFfDOI2hbfICmV7uikFgm

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

offer

C2

Spyt.no-ip.biz:60402

Mutex

7SLAH5244FP5YT

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Windows

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    5633

  • regkey_hkcu

    Windows Explorer

  • regkey_hklm

    Windows Update

Targets

    • Target

      d007b0aeb3683085efe2fef470362a71

    • Size

      444KB

    • MD5

      d007b0aeb3683085efe2fef470362a71

    • SHA1

      132eaa1b3e1196dc2af4a7398a341ebe7afc9a45

    • SHA256

      e72d7929b1390bac9b2211e0bad4e15b9f90d66929ff45af164ab3da0d73edb1

    • SHA512

      93c1a6665c4fb3cd4b8dcab3267a6cb2f43805f58d2a6451e4d87f3843180e5243ca51be17660a43907c3cfa8cd7ae108055200372c16ae4754c108920ad8008

    • SSDEEP

      6144:Ox9gTRkwQKetnrc4K2YLtsOfXXjXTpcI0YI7KIpbfklXhlVDX8mVdRQ/vqkg1gE6:Ox9gl8tnw4KDFfDOI2hbfICmV7uikFgm

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks