Extracted

• • Target

    db520d78fcdcda2633bf7028fdeb2dfd84383b9a29c2e7261c719693c8bb0211

  • Size

    365KB

  • MD5

    5461eca54dd7a46fc52b84a93e430476

  • SHA1

    0d3fcfb5aca093b5005c8bc62c4b8fa8fb31a497

  • SHA256

    db520d78fcdcda2633bf7028fdeb2dfd84383b9a29c2e7261c719693c8bb0211

  • SHA512

    a0df4f80761e0b9f80cc44ed2edf4cc5e16fc64f217568f524bf5b1dade4013a8160eb340d92676ca4207b2250d37a804d0c891128ceaa4790bff334e2cb02e5

  • SSDEEP

    6144:TgLxtJnhCM9GFgCiBoQXIEes8BN70i8DIHIhojbEOihmVl6i+YhBMsEYNr3:UoFgPBlXHeNNcDajHEORl6i+YsWZ3

  Score

  10^/10

  cybergatenew504persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2