Extracted

• • Target

    65f1afed0643793af69acb6e01bdae029b77a5978f79bb52ee9660d778a31af3

  • Size

    344KB

  • MD5

    70e0dbe4e282574c5497f3f80f30c960

  • SHA1

    b42e47dc0167f6938cd6e94050465f43a66bd364

  • SHA256

    65f1afed0643793af69acb6e01bdae029b77a5978f79bb52ee9660d778a31af3

  • SHA512

    47f39be7df3838af555725acbe1ebb28068faa2b21aa626e6147c8a6003fe6f978a0b09e2cebf4d930103d9c154d2c913fae2f889132d23a28a5caaf385067fe

  • SSDEEP

    6144:lmcD66RW5JGmrpQsK3FD2u270jupCJsCxCRI9aF53+:AcD66l92zkPaCxG3

  Score

  10^/10

  cybergatevítimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2