Extracted

• • Target

    cdf32d3ea1aaedda3b919838a5bd2f58

  • Size

    436KB

  • MD5

    cdf32d3ea1aaedda3b919838a5bd2f58

  • SHA1

    ae012a0472b57d2a0c91c7883e6810fd9e841e67

  • SHA256

    be8bb244f4b901c3be10bd8dfacdf6589e941990b0b6eb8206ca8e9bd688af18

  • SHA512

    2160810b553145f9034b00d3e8ff97302b61b3034c1cc6ac948dac7c789f8cd40b58255038d4babb896c4646155d045241a6c6d5b4762c8d37aba423158abfd1

  • SSDEEP

    6144:TA+DCK7y2R3sSh4GqVoLBd0eimypxlhq4jx92UqCnd2q+R7x8UXHpRDUMZftXl:TVdaDGz0Lmut5qcO7t5RDUA

  Score

  10^/10

  cybergatecyberbootkitpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2