Extracted

• • Target

    c4275a86fa2d6d42e00f15cdc4aa3a09bddd19deef2e5253f9d09b45dadbaaef

  • Size

    583KB

  • MD5

    b8c86d90b109edb252a41576f4a5fd1d

  • SHA1

    bb99d66dfbf11a768bb881d8ed45b85b9d22df4b

  • SHA256

    c4275a86fa2d6d42e00f15cdc4aa3a09bddd19deef2e5253f9d09b45dadbaaef

  • SHA512

    9308b43624d1bff2f33e91e7a6d066fabb6b47baa9ef012286d414f6d7a629ed5ef121f949559f4984d2555c823ef233ee56c587515244e0bc4e7072f9533518

  • SSDEEP

    12288:W6Wq4aaE6KwyF5L0Y2D1PqLxrTg65kje2chPlUWEQ5oateL0mRdHPBm5:cthEVaPqLJTSEUWE4oategWC

  Score

  10^/10

  cybergatex-manpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2