MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f83b65d22376b82a2f8304dbf3fcb8860a068ac34da291e8f067f17d64662c0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cybergate


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f83b65d22376b82a2f8304dbf3fcb8860a068ac34da291e8f067f17d64662c0c
SHA3-384 hash: 7df1c5c2cb67dbde87a4ddc3b92e45755d3d8c74272dabff3be1253b942020310fb726996c764b8069c72252d09275a5
SHA1 hash: 2e73a9431fdf92df82c974171563f6ae40494ae6
MD5 hash: a9ec0595ff347177d5d05631aa7e4153
humanhash: princess-fanta-stairway-echo
File name:AGENT GUIDE DOCUMENT.pdf.rar
Download: download sample
Signature Cybergate
Create hunting rule
File size:363'984 bytes
First seen:2020-06-20 12:56:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:mLxfxVlg/GDNe0d5cgA8LlucPMZvDTtz9+5+UhkWmbVP9WSUVn4/td7UzkKo6fha:mtf4GDNe0diecyOrteSVP9HUpQ/7SDK3
TLSH EA74234631C494756EDF233864E07F9AE53443284E5CC6A13B72F829C3A29A752EFCD9
Reporter abuse_ch
Tags:CyberGate nVpn rar RAT


Avatar
abuse_ch
Malspam distributing Cybergate:

HELO: hs2.name.com
Sending IP: 169.59.0.130
From: Ugo Egbuta <uegbuta@startimes.com.ng>
Subject: GUIDE DOCUMENT TO ALL AGENT
Attachment: AGENT GUIDE DOCUMENT.pdf.rar (contains "AGENT GUIDE DOCUMENT.pdf.exe")

Cybergate RAT C2:
johndns.publicvm.com:5190 (79.134.225.69)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 12:58:04 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7a5wlurdo24cul4datn7h7fyqyfancwdjwrjd2hqm7yx2zdgfqga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Cybergate

rar f83b65d22376b82a2f8304dbf3fcb8860a068ac34da291e8f067f17d64662c0c

(this sample)

Cybergate

Executable exe b363f4b3709b0bd3a60379fac80fd5d3fd67d3da7abe99044d6336e807642211

  
Dropping
MD5 f704d3ad9a00439ebcecba71388b40e9
  
Dropping
Cybergate
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b363f4b3709b0bd3a60379fac80fd5d3fd67d3da7abe99044d6336e807642211

Comments