Extracted

• • Target

    6a5663a22e09c79a44478854839ee0e5a844a17a1789ca5631e51d016961f12b

  • Size

    1.6MB

  • MD5

    10fbd92e90e11d2919af152765ec7cd5

  • SHA1

    c40e66f47e18c5b14f6b037a10aa9810a3a6fda4

  • SHA256

    6a5663a22e09c79a44478854839ee0e5a844a17a1789ca5631e51d016961f12b

  • SHA512

    19b8e2655162aa35287fe67926b850aef5752535a683f6dc394962081921c32813d3890a16747dec5779b84d5b9649a4812699948487ee7d84942a06e9930a03

  • SSDEEP

    49152:RJZoQrbTFZY1iaF6kRaaVwU1Z3r0wkjqiNo9:RtrbTA1okR4sZ3r0wGNw

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2