Extracted

• • Target

    db634ee9374d951b38fa8f38b8aea075142313eb7c58db9c808a99948142ffcb

  • Size

    2.0MB

  • MD5

    552a63532e9219e4c6e63592e269af2c

  • SHA1

    3338888bb45829133d08efa70bd61d56c061e5b4

  • SHA256

    db634ee9374d951b38fa8f38b8aea075142313eb7c58db9c808a99948142ffcb

  • SHA512

    3efbcf1a10c70206a87725b9d178ae091f757862a21e0f08361486a7c9121a7bf4a7c1b7846fa353c2929c86eb677125248845cbd6f6e42cd2de1abd5d76dc87

  • SSDEEP

    49152:kPb9TjglRe9+mCUymxeLeAURYihuKCY4h:kPbNjK7mC+klRsRO

  Score

  10^/10

  cybergatez2persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2