Extracted

• • Target

    ee04fe12be3f8c3a5a718807b3477d166c6ec6ab0e5f3df282aae2c666c340e7

  • Size

    353KB

  • MD5

    010e283a9294ff5fe5b20154274271d9

  • SHA1

    ca5395606752ea5e27e3c7ccfe9cecd95f1b7e64

  • SHA256

    ee04fe12be3f8c3a5a718807b3477d166c6ec6ab0e5f3df282aae2c666c340e7

  • SHA512

    6e5af1e00d389fd64baa2f5a98f9aa74746831c677a3a9f67bde674101383bc9f39f00bec9bd32179b77d36040a9efa2ecbcf19bff49ecf0cdf9daddf59beae5

  • SSDEEP

    6144:omcD66RD5JGmrpQsK3RD2u270jupCJsCxCsI913Q:hcD66sZ2zkPaCxq13Q

  Score

  10^/10

  cybergateöííépersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2