Extracted

• • Target

    5e91044e7e41f2d56b05553a6a19448a1857e7616821cc2e1f8495aedf5dd53d

  • Size

    831KB

  • MD5

    68d9978a180ea288d0404f1e04b64588

  • SHA1

    3973c24be6f0851cbfd6fffd083ca1ee6feaccb2

  • SHA256

    5e91044e7e41f2d56b05553a6a19448a1857e7616821cc2e1f8495aedf5dd53d

  • SHA512

    f0fb05efd155a35a30ef28ddcebce8958db3982b5a5e76bbe4383d9323c8b6a98e3c8a43bce970a3e27e2bbcd33b98cce049edc1eea52d76a24a90a4d5cd646c

  • SSDEEP

    12288:JSUbDlCJzdQpcDVG8R87zclHyfrQpwyW/PDJmmmKJ/WPdmEOdilIjUubKmFhekBx:Q++zSpn8RKFrJ3ZJ9IIgcfX/

  Score

  10^/10

  cybergatevítimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2