Extracted

• • Target

    be96d529001748ec2816f6ec81c734728af61622d24aff771080fce264a667f0

  • Size

    500KB

  • MD5

    1ffec4a81cd122db8c875c8a86e1ee25

  • SHA1

    93f459990b26e1457aca3a44f28e57d702102ce5

  • SHA256

    be96d529001748ec2816f6ec81c734728af61622d24aff771080fce264a667f0

  • SHA512

    5f7136713930128619a0e35a0656eacce4a09e929f78d99efc89cb130250a75fff62745c72498d5d99e67df2e051aa3219648eb76df9a01dafc5087021565f47

  • SSDEEP

    12288:aHDyYR3qxc8DQkDQ+pODfh357RTt/TIvu0/44myrp/z9AY7GH:aHOYR6xc8DnQ+pip7RTtAQ4pFzf+

  Score

  10^/10

  cybergatevítimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2