Extracted

• • Target

    afaf0535ba5bb34319018af6966309650cd1d061cb7b00716b70354a4050f735

  • Size

    444KB

  • MD5

    2a8be768ad768c49aa03ab767f5cc2cf

  • SHA1

    6b8ca24e5512c9bdcca6413724cc78c0bf1c5655

  • SHA256

    afaf0535ba5bb34319018af6966309650cd1d061cb7b00716b70354a4050f735

  • SHA512

    5dd586999a9938c3eee0c0d0909f15dc27f201955e1bc61c9ef1cdf542bc4584af388f8e5545ad96fb4fd50fd0ac9b9285aeae79b3e917e9ac872f1fb4b4693f

  • SSDEEP

    12288:y9SNDGZ2bAWukq0S/G/Js6jbX+sIolxAcS:gSlLbqk2cb/+sIoz7S

  Score

  10^/10

  cybergatemarocpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2