Overview

overview

10

Static

static

3

Autobuyer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a94813951f59e8acd4e72bb3893cca05

  • Size

    350KB

  • Sample

    250410-kq693awry8

  • MD5

    a94813951f59e8acd4e72bb3893cca05

  • SHA1

    8f2e16828af0e71b7f05c05f0fde63e79b84c6cc

  • SHA256

    88c36ac29da5e5487ecd62d46ce66539031c220ecc31ab5c794581cf601420c9

  • SHA512

    0ac711fad1c417add579192426456f1c16d84ff57d0fbdc14d752cb698e8704950b702910e2d470499565696284646e0360463fce5aee9bfb66fa5633c603136

  • SSDEEP

    6144:GxN6kLd53FksHZPB0r09hhxjGQLbPxboELyxQb4U023bkK/W:GxNdLv3FtZPaEpGOxUEZZr3YT

Score
10/10
cybergateremotediscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

kingmoker.no-ip.biz:1337

Mutex

IL686HAYU1251X

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

Targets

    • Target

      Autobuyer.exe

    • Size

      379KB

    • MD5

      34b0b469758911d2e5703b25b17c0acb

    • SHA1

      26b2f2cd045cfdf01ea25c561eb786776483abe0

    • SHA256

      42ec9c108fb200f0ab0db2418028f7b6f7e24622b40e6ba26c593102e127c24f

    • SHA512

      1fbbc18dbb645804f4c97238c950f3a610aaa066313c913baa03ef8dbed926ac189e61223770e8a8b982be15cf308ee3c4f2335b0022fb2fe946342a308f5073

    • SSDEEP

      6144:DzhDhVz4nqZb38b99K3FlQchem5TQ+g/3oc2ibInfqJS2RM2FUtgoPFAwvFjh2wv:DNDhVsnq5G21lr5TQ+gfoc2iUnfqJS2S

    Score
    10/10
    cybergateremotediscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks