Extracted

• • Target

    9f330824e3106c985abb4967dc6f8ba37aa7ce8c33abb70a8eaa9feff15e2d6b

  • Size

    1.4MB

  • MD5

    29a6deb602e8ba4a71b369c4aa48e89f

  • SHA1

    7cadb4beadab893524cc51e93c0b63ab89a87057

  • SHA256

    9f330824e3106c985abb4967dc6f8ba37aa7ce8c33abb70a8eaa9feff15e2d6b

  • SHA512

    92eec53b8d9e6d84d411bfeffccbf4c5c0a08e7e52acf63559d06385885153bae9891dbd9ed5652738dd1003979ba2c012fe409d4044b9d11a84076970d59f8c

  • SSDEEP

    24576:s3Syp13QWl/5IWU5bIjUUODz30/XpYceph11/GR6QDbIjUUODz30/XpYceph11/A:Wz9QaqaxU3WZepR/GR61xU3WZepR/GR5

  Score

  10^/10

  cybergateozipersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2