Extracted

• • Target

    5aef14ab4ffa77d9bf9c79a1f93cd953

  • Size

    936KB

  • MD5

    5aef14ab4ffa77d9bf9c79a1f93cd953

  • SHA1

    6e2aa32e116e542642028f56f35e9b452b19e8f3

  • SHA256

    a1e5da435c1fd84209aa4f69892cffbc44ace58ef71dd398f5ddcbf265d5f8f7

  • SHA512

    85f64aecdff1773c124e764d1bc08d11831c98b05a85555bd19068546dba7f5eaa1f7f8c43561795209496360af096d9189c34664a6bf535b40b223aa8eeec9e

  • SSDEEP

    12288:CSyoIcO/x+1yhYhrqok6iJ6OY0uzYp6FTConjG3L:CxoIcXRlkYOuzYp6hCon

  Score

  10^/10

  cybergatemuhkuhpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2