Extracted

• • Target

    d7e1163e330ad9205fc1da6476656dd0N.exe

  • Size

    424KB

  • MD5

    d7e1163e330ad9205fc1da6476656dd0

  • SHA1

    895d3dda522229f5647c091438b5962901a312da

  • SHA256

    b41ba7121c306936cf7ef9a834b0d81d8432e8ce6d43e406dff381142965ac4b

  • SHA512

    425598727453113486eec90457e7a3794c3ce047639a7416feaeb52d37ec309dbc0a0470b6646fa2c6d5012e32d34c4f2650471b19b39382fe84487147b8c368

  • SSDEEP

    6144:7BpnLBFB2E7jwl7HE8JA4IZSj7eHaTSTQnkPWcQON0hH4zU0rh:jF2E7MK8JLIyeHU5kPWxkUG

  Score

  10^/10

  cybergateremotebootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2