Extracted

• • Target

    0925c4773161afde1a2996920dd7a257ea2f3d1156487e80499e5f8cd2a8b11b

  • Size

    399KB

  • MD5

    622069ced026a4ffc53eea7474da10f0

  • SHA1

    1f247794d80f65bfda54da084daf134bcae9508b

  • SHA256

    0925c4773161afde1a2996920dd7a257ea2f3d1156487e80499e5f8cd2a8b11b

  • SHA512

    09981d65839437a3b6e3ed217858bd7b446b4bb2d3377936c58f90a4d7ac602e0b4c0e27c7e5a6714dde79f4c31a9799b5e98906060166f4695b816fcd53f423

  • SSDEEP

    6144:TzKyCcR3+ZFh63WHFEAE4FSHZycQzeWq6icB+KFvkRkZuo+mg8YOd9Pb5Jee5fv6:pvdTZylq6icB+M5unyYODfTG0e

  Score

  10^/10

  cybergatetest06persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2