Extracted

• • Target

    ee5d6a092ef6fab92c5ce097705b052defb56bd0a6c6650ec2c92f030680a5d4

  • Size

    499KB

  • MD5

    20bb9a2e5abdc1b1fbd20de5a16a53be

  • SHA1

    3ba89aed16fc48b4d64a8217c693bf5539507004

  • SHA256

    ee5d6a092ef6fab92c5ce097705b052defb56bd0a6c6650ec2c92f030680a5d4

  • SHA512

    f5f79629901ef735ea45d4eb9beb3e0bde9141a5df1a55a8212f9123969248ccacd141a5079367793dca5a5acdd8782bbeaf858992fdc502d41361b9e8c54793

  • SSDEEP

    12288:8s5U0eL+KsXN+DFTzBCjkoPuNsp8DUAwLf0XRho0Z/56:r5U0W+vXmFT4gomep8DdwAXrp/56

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2