Extracted

• • Target

    3995de6a0a26ee454ab2cc76e05632e8

  • Size

    1.7MB

  • MD5

    3995de6a0a26ee454ab2cc76e05632e8

  • SHA1

    600a0e97a9e248dd260616ebea068a651c8714e4

  • SHA256

    6ce6114c140ae1a5b71742bd7f9857d89103d5d64d9bd37d7c9670211b6c5c44

  • SHA512

    eaff30c7598baccd98139a600e2f55916a6a15231ceca4216139ee9a50f7f92d5f407a61731f71d0239e1e42f60ca99e2552e731dfbb37ac5d265e5ef6470e35

  • SSDEEP

    24576:s//jxKjZ43LbZPsKnaLlFPDcxyUxpGlpUuIi1X7riFEGyuOVUfWPSIPo2I1yulXE:sHjN7tCiWjdl7riD4sRao5Xxk1

  Score

  10^/10

  cybergateremoteevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2