Overview

overview

10

Static

static

3

8cf05013de...9b.exe

windows7-x64

10

8cf05013de...9b.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8cf05013debe5bfebfb43cd6ea093581f9fb33179d3297cde5d59f0e5cb9e39b

  • Size

    577KB

  • Sample

    250314-f1nhgswpy5

  • MD5

    68954c7245521d519cbb3a385cb2c148

  • SHA1

    a9ca115a8ba053d34b346712258cd38569fa9ff0

  • SHA256

    8cf05013debe5bfebfb43cd6ea093581f9fb33179d3297cde5d59f0e5cb9e39b

  • SHA512

    2c8c26c67d486d43f847fbb95d7e01ba38f4f6a57fb1ccf3b216909b2bd4228de68920e062711e48356b519660056281ae4f63e0fa743cb164004be755ce280f

  • SSDEEP

    12288:3FRfn0O/l1hgLzINJzTPudj+NVjVsrhwyvywWHb06ePuwCuqtgjN/yZsZra:nn//lXqzaTPQ+Wrhw0y5LsuwCXGym

Score
10/10
cybergateöííédiscoverystealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

127.0.0.1:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    t?tulo da mensagem

  • password

    abcd1234

Targets

    • Target

      8cf05013debe5bfebfb43cd6ea093581f9fb33179d3297cde5d59f0e5cb9e39b

    • Size

      577KB

    • MD5

      68954c7245521d519cbb3a385cb2c148

    • SHA1

      a9ca115a8ba053d34b346712258cd38569fa9ff0

    • SHA256

      8cf05013debe5bfebfb43cd6ea093581f9fb33179d3297cde5d59f0e5cb9e39b

    • SHA512

      2c8c26c67d486d43f847fbb95d7e01ba38f4f6a57fb1ccf3b216909b2bd4228de68920e062711e48356b519660056281ae4f63e0fa743cb164004be755ce280f

    • SSDEEP

      12288:3FRfn0O/l1hgLzINJzTPudj+NVjVsrhwyvywWHb06ePuwCuqtgjN/yZsZra:nn//lXqzaTPQ+Wrhw0y5LsuwCXGym

    Score
    10/10
    cybergateöííédiscoverystealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks