Overview

overview

10

Static

static

3

db1ac31ae2...98.exe

windows7-x64

10

db1ac31ae2...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db1ac31ae2d0da0fb541828501fa0998

  • Size

    796KB

  • Sample

    240321-jvj5nagd2s

  • MD5

    db1ac31ae2d0da0fb541828501fa0998

  • SHA1

    fe4edaf68bdf91b88fb0df9a7cd2a421bbd40672

  • SHA256

    c7640ec2333c3b41dadd8db433a2f56c484b637e14d9df5580207e7e69dd2ca6

  • SHA512

    c202c940c9e4e87bfcdbcce5d43cf65c257f38e8ea35fa200097512e0c587cf2ca3229fc80c89335880d0337810340dec24d312bfc60af92a69d91951ddb307f

  • SSDEEP

    12288:9hjaCWJzqRIlXn5tcMDxkB1UoRF0C3D/CA6HH1okoK/trCnfCEBbAGzoXhsCM1qs:5+nzcXBMsUp1JKPzEd

Score
10/10
cybergatebotstealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.15.4

Botnet

Bot

C2

hexrut.dlinkddns.com:82

Mutex

FHQI6T83R0F1VS

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    kehek

Targets

    • Target

      db1ac31ae2d0da0fb541828501fa0998

    • Size

      796KB

    • MD5

      db1ac31ae2d0da0fb541828501fa0998

    • SHA1

      fe4edaf68bdf91b88fb0df9a7cd2a421bbd40672

    • SHA256

      c7640ec2333c3b41dadd8db433a2f56c484b637e14d9df5580207e7e69dd2ca6

    • SHA512

      c202c940c9e4e87bfcdbcce5d43cf65c257f38e8ea35fa200097512e0c587cf2ca3229fc80c89335880d0337810340dec24d312bfc60af92a69d91951ddb307f

    • SSDEEP

      12288:9hjaCWJzqRIlXn5tcMDxkB1UoRF0C3D/CA6HH1okoK/trCnfCEBbAGzoXhsCM1qs:5+nzcXBMsUp1JKPzEd

    Score
    10/10
    cybergatebotstealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks