Extracted

• • Target

    eabea1fc49bcba8bbf69702ff6a6ba3bd541823857c6dcbfa6e4d1cb09bf1867

  • Size

    894KB

  • MD5

    feddd6ad5fd736e0ac7099e51f2303ab

  • SHA1

    ee888d475bb89fb2636dc4951be27a565bc748d4

  • SHA256

    eabea1fc49bcba8bbf69702ff6a6ba3bd541823857c6dcbfa6e4d1cb09bf1867

  • SHA512

    2e2f9d85d18e16f0485668c348dda24797cf8097a542621d74c69486182f2469bd534fc9b3e897b2ba4938625ba1388f3137e433d2894f4a30c19a7fe831bca9

  • SSDEEP

    12288:cxoQ5RTjymNTQDV5bJKsQIJN35orslCoTj7qXwnSL85tbz0f13kg+gIqYZyu8D+v:FQ5R6m1kVrKrIOyBjOXMfzgUvg4yu8DA

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2