Extracted

• • Target

    53ac0a79e89f1935f672e12c4151cddf

  • Size

    520KB

  • MD5

    53ac0a79e89f1935f672e12c4151cddf

  • SHA1

    11c869ec051b487eb6e7a354405c111beb8bdde3

  • SHA256

    9b08832289f82d63f2479a0e3ac0924f0f16b6f92c0c534e20dbbff9a72e229b

  • SHA512

    20693011cc5cf0dd38f27d6df182f7beba323da8e766ce45fb3eab06d1c2b995a524b90618185d9cf1f0dd5f8f6ac349fd97fb8002a1ae167366767c80e2ad45

  • SSDEEP

    6144:tSqjYYsDmEvUbbqakhQLeKfJc6KPs+Ac+RF+0Q0eXlxl6+huQCQL:bUvKiXakhQiKfJcVs+P+etl6urr

  Score

  10^/10

  cybergatecyberpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2