Extracted

• • Target

    89c6f303d37644daed82e7161c038154bcd605fce6bbf756978548f0762284c0

  • Size

    553KB

  • MD5

    3ecdd2f5be845935902ee14d6552b7c0

  • SHA1

    209ad761a37d0f38f9eaa9881da805150385ccf6

  • SHA256

    89c6f303d37644daed82e7161c038154bcd605fce6bbf756978548f0762284c0

  • SHA512

    9cff4e1d5263c45e38577ec5db573b4466bb33d7557d415b6b28189b8ce6c9e22ba799a2c8edb48d4b91336b21d45e9f2cfa290cd77cc2511a7fe5f3d682e039

  • SSDEEP

    12288:peiqRHIES/EftrPmICMbR8KVOo97+92RQRQz5Q5Qrq:peiqA/qpnCMbRXO8U2RQS5Q5Qr

  Score

  10^/10

  cybergate4chanevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2