Extracted

• • Target

    737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527

  • Size

    2.8MB

  • MD5

    d73a56d2f067fdcf8299b3578dd811d2

  • SHA1

    c523d4c624c4a2b181943e9b79a318d5e495492c

  • SHA256

    737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527

  • SHA512

    2b46924a844b932a386a0b7adfe816b9fb2e910db081edf912d025360508d542878fecc45867b8761468f281ef579f9eb73906bedc51e049cdccd633a9208ce5

  • SSDEEP

    49152:XAI+BXJZoQrbTFZY1iaRgY1irVLdi8gLMpYw2o3ALP5rZwJnD1tSf:XAI+BXtrbTA1VyVL0zDowLxVYbY

  Score

  10^/10

  cybergatefacebookdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2