Extracted

• • Target

    715f4d9a7628d25f01f6cf789feb165d.bin

  • Size

    609KB

  • MD5

    715f4d9a7628d25f01f6cf789feb165d

  • SHA1

    201b7ef2719069fbe9c54a749d490a081a025622

  • SHA256

    db6d687d6ed8e8c6a5ca8a13a61b308a70c0519d87483ec4c5e2fd5037c1ab60

  • SHA512

    b3fd54a1dde83a279f759875630b0802f11ae9558a3c41f8fbe033076ff25118b6db85c130193bfdee8c074bbbf73b1450542e2da37086f6c69d2377f1fd2e92

  • SSDEEP

    12288:4BMmKGnhDT+JlCwg1HwnHAAZkGoyd2l562Sj:aMmnDC+wyyfKp5Ej

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2