Extracted

• • Target

    c53ef1127eb6b7cfbfc66e2dc3bda01ef4e3339f88126fd97a37d3abc4887523

  • Size

    284KB

  • MD5

    6266d2e6451705f47fa4356c8ce584d1

  • SHA1

    a6cfdc01d48f77026d09ad66960dcab0876f216f

  • SHA256

    c53ef1127eb6b7cfbfc66e2dc3bda01ef4e3339f88126fd97a37d3abc4887523

  • SHA512

    1c547a46c45204389ca92738959b6512e6553ba7112a0da71e408e5129fa4fc4db6bc15ee6ac43ad405e55ebc1e7a56a3da05a94911497f1410650b0e73c5930

  • SSDEEP

    6144:Ck4qmhinpt6jQwgBTNVomhllBuFACfxGzMmCcXkFVA:99UipqgBTNVBfem+F

  Score

  10^/10

  cybergateöííépersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2