Extracted

• • Target

    5860ba9cba7c42f388a4a64cdd18d5c8d5552a7633d08f7382ab90c594bdd782

  • Size

    364KB

  • MD5

    36167f0647624b6151b707f7b7d41942

  • SHA1

    2f51271efd365e046a52a374757edf418182e28c

  • SHA256

    5860ba9cba7c42f388a4a64cdd18d5c8d5552a7633d08f7382ab90c594bdd782

  • SHA512

    deb77e8d3532e6bc479d3116cf660c2cc13158ce8738cc1b2dee97ad7710a050a4d2d68ebecc5cf0e57ef1b1d4874308bf5db44342b0acef3b2cba0117a5827e

  • SSDEEP

    6144:Yoii5i0cqNtP4qS1t0iEg5J0SQNLL1gjefU+pD7SEs48MV1t3RwxEH9:8Z5qNl4qS1Wa5yNzKeND7SE9FhLH9

  Score

  10^/10

  cybergatefb_soldaditopersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2