Extracted

• • Target

    c091d329eccfdf8f80c9acb667ff16c6

  • Size

    723KB

  • MD5

    c091d329eccfdf8f80c9acb667ff16c6

  • SHA1

    3ba287cdcb4212cd17df566a14496308758958ed

  • SHA256

    70edb2d598d6e7cc6d089eaac2bf866be8e950ce7830796533a583d02d85d3d8

  • SHA512

    899d055fa419a97f4707d7e8f1d55354a46b5442574cbbfaaf9e597f82cc8f8b5ee9b485e7ca7e469b7adfbadf5486a49f01b71b4093716a3bc0567d4d26034c

  • SSDEEP

    12288:ToXn9tDhU0Gfybuh4++NPtmPtg3WC+TBJeH87GAf11beNXg:UXn3RQoNPtmS3WC0JW87BLR

  Score

  10^/10

  cybergatepoppersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2