Extracted

• • Target

    SpyNet.exe

  • Size

    276KB

  • MD5

    ab78abc2a045b99b8727ac689defcd60

  • SHA1

    3df690683a432553ddf2aa0727b3e0410c63c8dc

  • SHA256

    3ef6e26aa9eecdd0a1396f2a33e01bd6207b5607658039ab4c30d1cc2755b24d

  • SHA512

    5ae77a08eda35845be5e16d32d32e485349153d4a66ac247b735ccd9846dead00e66cb120ed230659950ac0f7539cad4e6a81341dc0ace83f25116881cf781d4

  • SSDEEP

    6144:4k4qm/YAnDzZA3u7Ik3VQbybAQ8psunJQ3UyQ:D9a3y3ukjyA/plm

  Score

  10^/10

  cybergatediukdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1