Extracted

• • Target

    85d6f87c42e71f13d2d747d028121f0ec64b742ed4cf312f42aece77522347d4

  • Size

    352KB

  • MD5

    63d279292029fa4433908dd75bc388a9

  • SHA1

    f80dcbc184f5613b465f66222b530dec8c5f387c

  • SHA256

    85d6f87c42e71f13d2d747d028121f0ec64b742ed4cf312f42aece77522347d4

  • SHA512

    f7fcc705815a4f3afc19a6efb7abb9d443d2edd441e4ef2e51615c4da88f68815376211442779a2867825c9e0080b9d0ebb48f3d0e12fcb610525ec8bbd9dfbe

  • SSDEEP

    6144:bWoXPkfJwJnX4LjjOnkTVVxcdjBqa9702On3KZs45eSG6eTXMu9BT:bdXMGXqVfOdj8+JsIeSdWl9BT

  Score

  10^/10

  cybergateöííépersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2