Extracted

• • Target

    20fd7494aeb9aa2c7e05fb29d19244be0cdebd4c622ce0bbc8a970e1d4134ac9

  • Size

    1.4MB

  • MD5

    72a6654facc78bccf4b6c9cccc42009f

  • SHA1

    136db819b268b912600c8929f5a1d8997fbb3af6

  • SHA256

    20fd7494aeb9aa2c7e05fb29d19244be0cdebd4c622ce0bbc8a970e1d4134ac9

  • SHA512

    3c6c4e1ff288fcaf1d32463dfb5983138cf23c0565e254b71f3d4f1bb9ce72c96cc3e335c637abdf760a1e1f4067341d7958552901cec7d88c1d10a5fdb82835

  • SSDEEP

    24576:3wNHiSwZQ11j1310o3l9gGhQOK0Znjq+Ini5+:MH19IOKcnOG5+

  Score

  10^/10

  upxcybergateremote001persistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2