Overview

overview

10

Static

static

10

Pictures.rar

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Pictures.rar

  • Size

    32.9MB

  • Sample

    241217-tz8c6asqcw

  • MD5

    ee72786ed638b0a1ff4aaeab2930b124

  • SHA1

    9f4cc855008182d693fd95dfc1a01dfa86122e6b

  • SHA256

    f8362987559c18f86c3140f587c9afe2fb672bf8e7c9cef72a40b023340ba1d6

  • SHA512

    d69eb9647d110c91431392e2dfd8bdafab7fd41400ed60432335213657f3e526428ab4fd0db12c7a584959a37d9a17892c9a3b0042dc87a6a3e18f3f08a8a9e2

  • SSDEEP

    786432:LuXBszdWeJLr859RPyUE9ykGTxJM3O/vKxhNR58SzCFKvLYYdhwe1x3H1A4jwU:ixQhAdO+xhyNR58SzpzYgxx3H24EU

Score
10/10
cybergatedarkcometguest16_minremotediscoveryratstealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

127.0.0.1:999

Mutex

CyberGate1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

127.0.0.1:1604

Mutex

DCMIN_MUTEX-6NVM9VT

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    UK2Bgjd1gQ7p

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

Targets

    • Target

      Pictures.rar

    • Size

      32.9MB

    • MD5

      ee72786ed638b0a1ff4aaeab2930b124

    • SHA1

      9f4cc855008182d693fd95dfc1a01dfa86122e6b

    • SHA256

      f8362987559c18f86c3140f587c9afe2fb672bf8e7c9cef72a40b023340ba1d6

    • SHA512

      d69eb9647d110c91431392e2dfd8bdafab7fd41400ed60432335213657f3e526428ab4fd0db12c7a584959a37d9a17892c9a3b0042dc87a6a3e18f3f08a8a9e2

    • SSDEEP

      786432:LuXBszdWeJLr859RPyUE9ykGTxJM3O/vKxhNR58SzCFKvLYYdhwe1x3H1A4jwU:ixQhAdO+xhyNR58SzpzYgxx3H24EU

    Score
    10/10
    cybergatedarkcometremotediscoveryratstealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks