MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 220afdc07395514a4a517473cf3473cf1307ae597cfe924b0d05b0958f68852e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CyberGate


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 220afdc07395514a4a517473cf3473cf1307ae597cfe924b0d05b0958f68852e
SHA3-384 hash: 7b85b790bddbc8e2561cf77e3ccda00147677b753eba99c744c9bb34dbee989d6bbf0e8192641208f1e3346b27dcf5aa
SHA1 hash: d3a7c990e1006696c0c067b794b93613657cd2cf
MD5 hash: ac663823430a9bb4ac4e75fb03ddc0e1
humanhash: uranus-hawaii-red-idaho
File name:SecuriteInfo.com.Variant.Symmi.8933.7059.14767
Download: download sample
Signature CyberGate
Create hunting rule
File size:491'520 bytes
First seen:2023-06-08 16:28:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 226e959f376c12d4fd7272da9253903b (1 x CyberGate)
ssdeep 6144:Mo/Q3qHpO2qTIM3BOKECeTNYwLumaOVPDKAESk3jsnRatBofFi5nTEZYjzb:Mo/iqFW0KhSYAu4PDrojsnR67EZw
Threatray 53 similar samples on MalwareBazaar
TLSH T1EEA46CE07741C461E85375FA843A95A7A5336E1E9E58144E2AB5BF0B3D72383CC2389F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 3d6cecccd6c37131 (1 x CyberGate)
Reporter SecuriteInfoCom
Tags:CyberGate exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
288
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Symmi.8933.7059.14767
Verdict:
Malicious activity
Analysis date:
2023-06-08 16:39:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/72c191ac-3dd3-4598-a040-450762439110

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CyberGate
Create hunting rule
Link:
https://www.capesandbox.com/analysis/397053/
Detection(s):
SecuriteInfo.com.Variant.Symmi.8933.7059.14767.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Unauthorized injection to a recently created process
Сreating synchronization primitives
Creating a file in the Windows subdirectories
Creating a file in the %temp% directory
Launching a process
Searching for synchronization primitives
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed xpack
Link:
https://www.filescan.io/uploads/648201f54f821962ae1dda58/reports/8cecca2d-7aa8-450b-8f89-0e053d24ab9c/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/220afdc07395514a4a517473cf3473cf1307ae597cfe924b0d05b0958f68852e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Rebhip
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2825e85b-c1fd-45f1-ac0c-04241cdef063
Result
Threat name:
CyberGate
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1251349
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Contains functionality to modify clipboard data
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected CyberGate RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 884372 Sample: SecuriteInfo.com.Variant.Sy... Startdate: 08/06/2023 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Antivirus / Scanner detection for submitted sample 2->38 40 5 other signatures 2->40 9 SecuriteInfo.com.Variant.Symmi.8933.7059.14767.exe 2->9         started        process3 signatures4 50 Detected unpacking (changes PE section rights) 9->50 52 Contains functionality to inject code into remote processes 9->52 54 Drops PE files with benign system names 9->54 56 Injects a PE file into a foreign processes 9->56 12 SecuriteInfo.com.Variant.Symmi.8933.7059.14767.exe 5 4 9->12         started        process5 file6 26 C:\Windows\SysWOW64\Sys64\svchost.exe, PE32 12->26 dropped 28 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 12->28 dropped 58 Creates an undocumented autostart registry key 12->58 60 Injects code into the Windows Explorer (explorer.exe) 12->60 62 Creates an autostart registry key pointing to binary in C:\Windows 12->62 64 4 other signatures 12->64 16 explorer.exe 3 5 12->16         started        19 explorer.exe 3 5 12->19 injected signatures7 process8 signatures9 30 Contains functionality to inject threads in other processes 16->30 32 Contains functionality to modify clipboard data 16->32 21 svchost.exe 16->21         started        process10 signatures11 42 Antivirus detection for dropped file 21->42 44 Multi AV Scanner detection for dropped file 21->44 46 Detected unpacking (changes PE section rights) 21->46 48 3 other signatures 21->48 24 svchost.exe 21->24         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/220afdc07395514a4a517473cf3473cf1307ae597cfe924b0d05b0958f68852e/
Threat name:
Win32.Trojan.Symmi
Create hunting rule
Status:
Malicious
First seen:
2011-09-14 14:16:00 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
28 of 37 (75.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eifp3qdtsviuussrorz46ndtz4jqplszpt7jesynawyjld3iquxa._file
Verdict:
malicious
Similar samples:
0cbefd9fa36902937cb5e57f8b7fb1a476498c6dd4fc0fcdee2bfbba5b0e9bce
CyberGate
3ba8a562f78af7776675f128f12777144fc3c73a471d8efb1950728179bb72d9
CyberGate
8c0ad323d189a9eac013425b57059204c026454d49a4a35d545e013d9d99b756
CyberGate
b363f4b3709b0bd3a60379fac80fd5d3fd67d3da7abe99044d6336e807642211
CyberGate
c9438b713777ed2c8a044560495e0a07e7c7ad74e74e51fa736fa7cad0127ca4
CyberGate
d6260dfe90cbc3e03a188d9e1128d14b3b17b851fb7f13da97ae67ffc50e35ec
CyberGate
d92a606bedfa843a95a54253d544ecd03c944cce85da4183489ab1a77cb33624
CyberGate
f1919eb7df810747c3eb5fb6e94e9d67981d9f560262f21260b5cbe85f950305
CyberGate
+ 43 additional samples on MalwareBazaar
Result
Malware family:
cybergate
Create hunting rule
Score:
  10/10
Tags:
family:cybergate botnet:responsys persistence stealer trojan upx
Link:
https://tria.ge/reports/230608-ty96cshe9w/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
UPX packed file
Adds policy Run key to start application
Modifies Installed Components in the registry
CyberGate, Rebhip
Malware Config
C2 Extraction:
46.183.216.145:80
Unpacked files
SH256 hash:
ff09e3e31debee898be4cd083c8b37616a43216ab586108d8653d31dba2a3a19
MD5 hash:
2b26b6b3b796a11f66f1fd0aedd86023
SHA1 hash:
67a20aed80dae2162bcf13736a6027f78178844f
Detections:
win_cybergate_w0
Create hunting rule
win_cybergate_auto
Create hunting rule
Link:
https://www.unpac.me/results/511288a1-eb77-4b8d-8b44-9ad0b212586b/
SH256 hash:
69b1b644c816ff4c455b70c9b3c1b1d1c26fe4f5a245957992bb8884b5d74f9c
MD5 hash:
6900266c30ddfc9d6b07f508ce1246fb
SHA1 hash:
20b3b577caa866f8e8c6f5d99abb7190e242cce3
Detections:
win_cybergate_w0
Create hunting rule
win_cybergate_auto
Create hunting rule
Link:
https://www.unpac.me/results/511288a1-eb77-4b8d-8b44-9ad0b212586b/
SH256 hash:
220afdc07395514a4a517473cf3473cf1307ae597cfe924b0d05b0958f68852e
MD5 hash:
ac663823430a9bb4ac4e75fb03ddc0e1
SHA1 hash:
d3a7c990e1006696c0c067b794b93613657cd2cf
Link:
https://www.unpac.me/results/511288a1-eb77-4b8d-8b44-9ad0b212586b/
Malware family:
CyberGate
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/220afdc07395/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/220afdc07395514a4a517473cf3473cf1307ae597cfe924b0d05b0958f68852e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:Malware_QA_update_RID2DAD
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One
Rule name:win_cybergate_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_cybergate_w0
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/397053/

Comments