Extracted

• • Target

    3b023686ad8a6a730a58a7d6607386f5ba0db85c6805e3000681215db47d99ba

  • Size

    365KB

  • MD5

    d23988891862ca95a6586d315d64535d

  • SHA1

    a1011d3cbe756b5a2db5187e77478386564a2e3f

  • SHA256

    3b023686ad8a6a730a58a7d6607386f5ba0db85c6805e3000681215db47d99ba

  • SHA512

    2343794832523a87f980c608756f1c21ed854b2dbaa86610dc2ddcb5d32341973ac1b7b186108029de3a1c1127a39343070d1a84daef74f35dffb7611f3a077e

  • SSDEEP

    6144:PiPxzj0yK871+5aCvqCloeuJphbDBGJPWlOykoqP0e2l7bnuXH3K97evseLZB:6p0yKMAarSoeuFfAJP1o+0/unK97Z4

  Score

  10^/10

  cybergatevítimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2