Extracted

• • Target

    c73f9f42950ae6a2cb95878a2b494139ba819ab3ccd9d0853783f4eca2500b62

  • Size

    457KB

  • MD5

    5a5862e77b9fea4402ba14dd540f61ca

  • SHA1

    60c2ac95f800f83b98b3e43fba495917e5604d65

  • SHA256

    c73f9f42950ae6a2cb95878a2b494139ba819ab3ccd9d0853783f4eca2500b62

  • SHA512

    9289e20cf2c2560c16fd1d621c9120989bf3d1faa75896eabb2a9c8e72117543f58a1831db0b0c3391fbff253cca6c70328384e61387a45eb59e228ae15043e8

  • SSDEEP

    6144:iYurkSh4HjSh4HobUbZ1Hr1+O4ToRywuBrc2nQqXUlUP9Zu7rycpUpd0Ufi8Zglb:vurDr1e5r1+1mZm4CQqIUj8rAd0YHXM

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2