Extracted

• • Target

    ea8ccb0e98e82f33e212de01780ad2fff29f786d1cbb30f2c98347321a1fc925

  • Size

    284KB

  • MD5

    02727b197ef81872adc1fa1baa973568

  • SHA1

    106e0a2c2116deff4a64e04eac6c128897a9c035

  • SHA256

    ea8ccb0e98e82f33e212de01780ad2fff29f786d1cbb30f2c98347321a1fc925

  • SHA512

    b76fe3d42272dd0dbd075d4ac707a5e19cdc57ad1a1551fe8bd4e4b3ba545bb04cb4f57f42d35a1b6d1a6a7d6b29b2b5689e849fade056e72e19fdec42732a18

  • SSDEEP

    6144:vk4qm4Z+TU/gOYfwkyneOlE50IvKPcjWUSGG+Ujg+XC:c9bJgODWB56/0Ujgs

  Score

  10^/10

  cybergate222222persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2