Extracted

• • Target

    ccf7daabc540e8728da30d24ca5d861db7a333a1cb996187efa6a7161ed41f88

  • Size

    424KB

  • MD5

    a34227b2331b5d55c1891bf8402dcc81

  • SHA1

    4ea236b5279c343b38532c6f959a9043531da677

  • SHA256

    ccf7daabc540e8728da30d24ca5d861db7a333a1cb996187efa6a7161ed41f88

  • SHA512

    c576b6243898813eb49e7b205187f2a1b72b807a0cebb855e8a4965d68fe9161b73a169ed672a656871984f5ec2edb93a7b37c07bd0dc0f358119688f5f322e6

  • SSDEEP

    12288:jbKvHXviym3zeiCuO1kPJEkUtbn3jW1j4KF4MVjCDxFsmB:/KvHXv/m3vCBe2bn3joF46WlFsmB

  Score

  10^/10

  cybergateöííépersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2