MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be404ffc5c363f80e7099a43a46c1ccd39f8593c660fd947bd8898ab44dd9731. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CyberGate


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be404ffc5c363f80e7099a43a46c1ccd39f8593c660fd947bd8898ab44dd9731
SHA3-384 hash: 067a6de193eec95754e8f0093f30b30d107496cb538a43fc31e46ff78be829e051885769c7ab3bd0acf549ed3f42d48d
SHA1 hash: 0129fcad6eaa1a209980e8a947189010862bab1c
MD5 hash: b99bf467c59d9ab27394ee068a7d9056
humanhash: neptune-cup-georgia-echo
File name:be404ffc5c363f80e7099a43a46c1ccd39f8593c660fd947bd8898ab44dd9731
Download: download sample
Signature CyberGate
Create hunting rule
File size:646'656 bytes
First seen:2021-02-28 07:20:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:/sWf2aWBMWXOIW5tul/xQdgtLFYK4Nja60K4Qv:xfWdOIW5tul5QiFYK2ja7Sv
Threatray 2 similar samples on MalwareBazaar
TLSH 0FD412493BE9DE73C785AB7461B382407B33CB5A6A63EBC3945901286EDB7D17D200D2
Reporter JAMESWT_WT
Tags:CyberGate

Intelligence

File Origin
# of uploads :
1
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
be404ffc5c363f80e7099a43a46c1ccd39f8593c660fd947bd8898ab44dd9731
Verdict:
Malicious activity
Analysis date:
2021-02-28 08:51:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/da9dcd67-6717-4f94-bf2e-c3e98d74af28

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CyberGate
Create hunting rule
Link:
https://www.capesandbox.com/analysis/119906/
Detection(s):
SecuriteInfo.com.Variant.Adware.BrowseFox.62.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
CyberGate
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/620935
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected CyberGate RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be404ffc5c363f80e7099a43a46c1ccd39f8593c660fd947bd8898ab44dd9731/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 16:41:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
b620d76117123aa2d044495ee0c0d85b5c1ba0985cb53cb149a350da07ea003c
CyberGate
e04d6e71187d48e516364df5e1d57005cf6d3bf581510ef944ae7f7480693a58
CyberGate
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/210228-ba1th7mfke/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Unpacked files
SH256 hash:
9c4979eeb3b37c074bb960382a24610344dc0520e42e1283681acc087c0c4e6c
MD5 hash:
1268ff8f3a5a4b63e87d93e26712bf9c
SHA1 hash:
388f0d1faa03328fed1e5ad475704dc8062686eb
Link:
https://www.unpac.me/results/b2a487e0-fa67-44e7-85c5-ad0647a256b4/
Parent samples :
3a201be90785dfd13998a866d6fa8a34c36b19c2a8b4edc784cd99760697ce33
8853434d42ddc17ae2ca12627546b9fa02baf6da6678ede0dc7db3979f85fd50
1026aebee8871b8d77864082815791dfb28c28c0c234fb12b068c9aeae13feec
SH256 hash:
dd25c682416c42f88113126104ab6f33e6b8ebd35792d0fb5cad40a2737f87f7
MD5 hash:
74580843292d27d262fd9002912fa035
SHA1 hash:
a82f7078aefad768e59be1ed5b91209f1c5ee2ea
Detections:
win_cybergate_w0
Create hunting rule
win_cybergate_auto
Create hunting rule
Link:
https://www.unpac.me/results/b2a487e0-fa67-44e7-85c5-ad0647a256b4/
Parent samples :
8c0ad323d189a9eac013425b57059204c026454d49a4a35d545e013d9d99b756
f1919eb7df810747c3eb5fb6e94e9d67981d9f560262f21260b5cbe85f950305
16475b2dabce04660e1f6127adf54827b7cf024f4cded92b9be6e07c85ae7a89
be404ffc5c363f80e7099a43a46c1ccd39f8593c660fd947bd8898ab44dd9731
b23d910f08643f0c79f08297aad168634e6f5a5552eb469f4b7e0bce2b0568b5
c9438b713777ed2c8a044560495e0a07e7c7ad74e74e51fa736fa7cad0127ca4
d92a606bedfa843a95a54253d544ecd03c944cce85da4183489ab1a77cb33624
10214ec31eefe2eabd38262e9a404f781949bd09ff3831ffd3a9d9f9c8a277eb
3a201be90785dfd13998a866d6fa8a34c36b19c2a8b4edc784cd99760697ce33
8853434d42ddc17ae2ca12627546b9fa02baf6da6678ede0dc7db3979f85fd50
1026aebee8871b8d77864082815791dfb28c28c0c234fb12b068c9aeae13feec
SH256 hash:
9e01d05a6fc5e2a10cbf6393fa29138c1c086fcf9be9e8bc3804a72fea540023
MD5 hash:
4d8d0c5751d935019308c713cc74b37d
SHA1 hash:
fc0948ec437fc1130e4d1de43665b7400da0a8d4
Link:
https://www.unpac.me/results/b2a487e0-fa67-44e7-85c5-ad0647a256b4/
SH256 hash:
51249af5522bdf0d5911c8da94f88f16065ba714af9ed9404264afadf13a11d3
MD5 hash:
4f70ee4cab3aa9c0a26da43c472b25b2
SHA1 hash:
25b716861cf73e667c70852fe35cae54c1d1151a
Detections:
win_cybergate_w0
Create hunting rule
win_cybergate_auto
Create hunting rule
Link:
https://www.unpac.me/results/b2a487e0-fa67-44e7-85c5-ad0647a256b4/
SH256 hash:
be404ffc5c363f80e7099a43a46c1ccd39f8593c660fd947bd8898ab44dd9731
MD5 hash:
b99bf467c59d9ab27394ee068a7d9056
SHA1 hash:
0129fcad6eaa1a209980e8a947189010862bab1c
Link:
https://www.unpac.me/results/b2a487e0-fa67-44e7-85c5-ad0647a256b4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be404ffc5c363f80e7099a43a46c1ccd39f8593c660fd947bd8898ab44dd9731

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxProductID
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifcats referencing sandbox product IDs
Rule name:MALWARE_Win_CyberGate
Create hunting rule
Author:ditekSHen
Description:Detects CyberGate/Spyrat/Rebhip RTA
Rule name:RAT_CyberGate
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects CyberGate RAT
Reference:http://malwareconfig.com/stats/CyberGate
Rule name:VMware_detection_bin_mem
Create hunting rule
Author:James_inthe_box
Description:VMWare detection
Rule name:win_cybergate_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_cybergate_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/119906/

Comments