Extracted

• • Target

    4a65f8e335381eb93f30036bc05652e5

  • Size

    670KB

  • MD5

    4a65f8e335381eb93f30036bc05652e5

  • SHA1

    c56462f46ad15e2fa3fd044eb4c2476e41abf0f9

  • SHA256

    cfe88ff0c1d88dae161cab2dfc9381d8d4cffcde1ba61f0fdc48dac466c56531

  • SHA512

    4e89cc10ea9587e9c85b0bdb16c6cf27022cfe8f5c5b1866c0df3c61b6a2bb4b54865c6c2d45fb81da12d60d8d43f96c46a0689f465674313ff876fa2c74a891

  • SSDEEP

    12288:fw80KZh/N1ty6xa8WmlgsaIihanZryw//aMs2yRUPe9uqyS1uqc9lui0:fw80Kx1AiW2V9Mw/SlBwac9Yi0

  Score

  10^/10

  cybergatevítima2702persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2