Extracted

• • Target

    02b4e3f0e73a73ced28d3e5cd39b7e4f

  • Size

    354KB

  • MD5

    02b4e3f0e73a73ced28d3e5cd39b7e4f

  • SHA1

    0de3bfbf72d3cffa6a956b4d60b0d6a6abca33c4

  • SHA256

    fe3fc49312d1343414cb670df5ec9c7532d66f403bfe47aec111a10ad8a400ce

  • SHA512

    17e5442d14cada74c358e9a26afa05cf6da92f873bc106f6c3865191e7a46154b278d7156192f04cfb32a65cc4230cfee83fd0f285dcbe51b31a9c0568fee404

  • SSDEEP

    6144:4jsirCNQyAbB3D3z/Lrz6KcYH3lfkivRiQMMpN609qINc:4jsLVAbBjz/Lrz6sqUEQkAT+

  Score

  10^/10

  cybergatehoaxpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2