Extracted

• • Target

    8ca4cebef838b69b922847d263c9dcad43c551476f400ceacff11266d78d4bf7

  • Size

    428KB

  • MD5

    7369a6b1dc8478d763ebc4b3eae90a31

  • SHA1

    62764d6a819c16f9d25015ac7f62b7b58eb571d9

  • SHA256

    8ca4cebef838b69b922847d263c9dcad43c551476f400ceacff11266d78d4bf7

  • SHA512

    51986ac5b3028e1b6d4ed7471ea3deb4e84231fbd18402dc7f26cf0a7d116833293c46dc64df6efce1bd1c0c69ed2163272e255d89340e101410c11ec60d34a0

  • SSDEEP

    12288:BuMwGBi8vvrHxVPKyv2m77sZB07FxObO32w:BHwv8vrx52t07FQaN

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2