Overview

overview

10

Static

static

3

29fae075cf...dN.exe

windows7-x64

10

29fae075cf...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29fae075cf59c67bb506c804179841a16034ed111e104579e991394eb7be2d4dN

  • Size

    328KB

  • Sample

    241014-m569qateqc

  • MD5

    30103fd1b25125c497fed438a3190d70

  • SHA1

    7b76f492ed4e5dc192b3ba8ca456fb6b6285e479

  • SHA256

    29fae075cf59c67bb506c804179841a16034ed111e104579e991394eb7be2d4d

  • SHA512

    24b53189199673a6c9fc7d6ef612d2906f07a7fdbbbc55673150fcaf2246e345596df467e7e47f198318a9fe909c69f4e15a075e1480ecd099a000c0de1b2e0b

  • SSDEEP

    6144:kxbL2McLySej98Zkn2jy8P77IWkArG50AOCzWPdTZrmqD6nC:kxv2MxSknWyynIWkArGoCaq3C

Score
10/10
cybergatevítimadiscoverystealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

127.0.0.1:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Targets

    • Target

      29fae075cf59c67bb506c804179841a16034ed111e104579e991394eb7be2d4dN

    • Size

      328KB

    • MD5

      30103fd1b25125c497fed438a3190d70

    • SHA1

      7b76f492ed4e5dc192b3ba8ca456fb6b6285e479

    • SHA256

      29fae075cf59c67bb506c804179841a16034ed111e104579e991394eb7be2d4d

    • SHA512

      24b53189199673a6c9fc7d6ef612d2906f07a7fdbbbc55673150fcaf2246e345596df467e7e47f198318a9fe909c69f4e15a075e1480ecd099a000c0de1b2e0b

    • SSDEEP

      6144:kxbL2McLySej98Zkn2jy8P77IWkArG50AOCzWPdTZrmqD6nC:kxv2MxSknWyynIWkArGoCaq3C

    Score
    10/10
    cybergatevítimadiscoverystealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks