Extracted

• • Target

    326eb9ccd07aa6d1d9b46ffee4cd1cff6de47a20e3c8bfb447ae9ef5b18b80f3

  • Size

    295KB

  • MD5

    369cfd39f18801884419694bc7a252ca

  • SHA1

    c3566e3052c32a3d6f4e4f7f65529992961593a6

  • SHA256

    326eb9ccd07aa6d1d9b46ffee4cd1cff6de47a20e3c8bfb447ae9ef5b18b80f3

  • SHA512

    988a87ce6cc569af62a50007e22ae602954db1e0ef63c0eb66722dae6afc60df9271ced0967ff7a04ee2a0dc3cb97cde98f34520745cee4c55b46c57e8df9b31

  • SSDEEP

    6144:Bk4qmBNFJqJxxy05Q33rVSIHnMoRJY2OTSKMuhbqLrMo7z+eleEb:W9oAxxrE30TSh2ar9P

  Score

  10^/10

  cybergateìïíï çáãæèßópersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2