Extracted

• • Target

    bfc757d3ceab7e6e023fabaf94e15db336cef1172a43771c9d6ebc30d8452ec0

  • Size

    388KB

  • MD5

    453c8aebe0e03438c682d85848191234

  • SHA1

    4e5f8505ec2048df16b6af2e3494e49100846410

  • SHA256

    bfc757d3ceab7e6e023fabaf94e15db336cef1172a43771c9d6ebc30d8452ec0

  • SHA512

    b3e26d1e04a5e400003b707e4c9b5e71717036fde15eb40956cd3de8538ab4403677cffe1ed4968b16b5ddd8710c2fbd38d91ead7df55e8f8aaa78e1da618806

  • SSDEEP

    6144:SqqpiuxY1Q9ECpFrKHiOo6RUQcprINU9qSisajf6j2HmcAmEPDalB7eq:SqqpikrKHix6RvcpyKHajfY2HHAmo88q

  Score

  10^/10

  cybergatecybergatebootkitpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2