Extracted

• • Target

    8919112b7919f2d24dab339614909e0a

  • Size

    575KB

  • MD5

    8919112b7919f2d24dab339614909e0a

  • SHA1

    ee824497e7812bb11e4ae3eeb9c546b6cd4f48b0

  • SHA256

    aedf9eb9f99bd157d54338b71262ed842776883d66bf099376ed82e9d9c738bd

  • SHA512

    5895e762d71ceb6028fcdd28fe0355f7eccf2dfe74495d2f92feb0a3330e1f6ffc5dff3e42a0dfc4cf8beef54363fb5f7e173d040e814dfef2ac83ec7bfb7abf

  • SSDEEP

    12288:/ExIE7F8UJfbCOdJSVgtqBAtvEjpOTjsIHFy8c02kXAasWEHNcckln6MA52fE9TQ:UBTjPdJ0gyjZUTUN4MZ

  Score

  10^/10

  cybergate4chanevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2