Extracted

• • Target

    ad241f7351e9fbece897e414465d83a5fcdeb34e591734ad46111087b0f6a522

  • Size

    5.3MB

  • MD5

    87f425ce31e49d320be009318a4894f2

  • SHA1

    eea64070bb3c4fd61b854180fd6aa6f08abd4f88

  • SHA256

    ad241f7351e9fbece897e414465d83a5fcdeb34e591734ad46111087b0f6a522

  • SHA512

    6c43da6360e0b64b59693abe5500d1ec8cea8a9f4c1b5f636847af81cf9fec0c3b50e5e5627858c0a6d3d96ede49b0cdc8cd76a4e446ab6dd1b12f9e73f892f7

  • SSDEEP

    98304:ZKZLrzbucj8Sv41erznH2xgZ0T3g/05pQIfzgbMR0OsRss6EI51+rxDZlYpViHMZ:ZuDIGHWiZopgbMR0OsyseQ9Me9f6

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2