Extracted

• • Target

    c53437438f74ee62bbc21cc6c62ef2d8257f43edebbbbe0016128ce067bac90f

  • Size

    305KB

  • MD5

    669e4e6c812d43d0b1961c82014b922b

  • SHA1

    7f9e2d943721388fc2761f7496c8af1d77a5d498

  • SHA256

    c53437438f74ee62bbc21cc6c62ef2d8257f43edebbbbe0016128ce067bac90f

  • SHA512

    72a34fbb63f6db14d1605ccde0ac7728390b1f891650a058b3b54b1f6894e09463803b6104d525397cf678a4623e24271071f9612b407df286a57c911a49b436

  • SSDEEP

    6144:z059bF7N7lPiRD81EOt+uocfOgOxdEbkPJaCZovEXxQvxDy8H23flTYJ1ajgnr/k:zS9bF7Ny5Ep7f1OkIBbXxQvxDybt81ah

  Score

  10^/10

  cybergatevítimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2