Extracted

• • Target

    f3bd6e2bf8d5d886727ed8e2808dee666d30c5c936b859e09fec733d8e351d46

  • Size

    620KB

  • MD5

    82854708ac9defe4f10d13b37c8694e7

  • SHA1

    7ebe84bdabe6746ef8048ff926aa6a808aeef24f

  • SHA256

    f3bd6e2bf8d5d886727ed8e2808dee666d30c5c936b859e09fec733d8e351d46

  • SHA512

    6e0f656f72289197021130906e8fb4f2eab45deaf570b76fa543477e355d82603c2febe229b6f85aaa0d6e8e4a5449596af73b7eb0c0a583a75ba02891978663

  • SSDEEP

    12288:acD66OZ2zkPaCxyDGCueoYrL/OHpE6E5jX8MuUPybafvY:azZOkl52ooL/OJE3T8WyWo

  Score

  10^/10

  cybergateöííépersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2