Extracted

• • Target
    7895f2756b492942a55e6bc0cffb7a4b03c665e0e593954a7a3353abd04babb8
  • Size 380KB
  • SHA256 7895f2756b492942a55e6bc0cffb7a4b03c665e0e593954a7a3353abd04babb8
  • MD5 0852d08dff85c550b5da005a235316b7
  • SHA1 5cbff49f6f44aa507b82c8bada6c21792f88f37d
  • SHA512 e3001f2c75faeaf8656c8f4e79d33072ae319e68913feaaaeab671b359f1c4e2320d97fdeebbc9e3fee7ab2d5d039cf651fd9847feae134a085368604d5e220a
  • SSDEEP 6144:T7BctRarUEdnOXVr9OY1fROtBx3VqcEeV/T0lTDy/Hrte4d3fiepfExpLr7mr:Ts0Lnop9OAkD+ctlwlSsepwFr7mr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cybergatefacebook spread !!persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2