Extracted

• • Target

    faf7a7f6f5197ae698ec0454f1ddcdde7ae26ed3bdc155228e8573a0bc34b6f7

  • Size

    396KB

  • MD5

    78810510d077724378ca822596616644

  • SHA1

    66fafa50c7b17c638947935a531f5d84d4d16c97

  • SHA256

    faf7a7f6f5197ae698ec0454f1ddcdde7ae26ed3bdc155228e8573a0bc34b6f7

  • SHA512

    4749bc738109aa61c4519e984ce286a34108f2a52d67e262702cd98a97cea96e6e677af87fb2da59de35a7add3632c13f2316ea9f2082abdfa06c1e4900e94cd

  • SSDEEP

    6144:ymNjYuKj/4pTNSbaKoyeuVln3HRC0Upt50VKqttqL3gsYm+YM/pn0qzOIi19DlrT:7AOnKoyeO3HkbpgZsMj0h0nVn2PG4F

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2