Extracted

• • Target

    3026b6c4ab157d7854fdc282eaecd047f6a64ea18134a8bbdb2b272bb6befc0b

  • Size

    291KB

  • MD5

    0eabfa1a9786edbd65b69a482fcac4d5

  • SHA1

    3c1fb9db1b78c00978b08f5cb99f39fc27cc7b92

  • SHA256

    3026b6c4ab157d7854fdc282eaecd047f6a64ea18134a8bbdb2b272bb6befc0b

  • SHA512

    399d9956481658b611086739b7afa72ca97f6c4ec338410ce5244d1eac142607a35665f773784bafa32626cfd9aeda25eb5e9c9b6581cb93f8a3710681259c5c

  • SSDEEP

    6144:ImcD66RRjecQEIXKgQjr0ksTdEBToREujB5wZl5DLfVq4mExyB:BcD663DeKgQ/iID5LfV13yB

  Score

  10^/10

  cybergatebolboltordiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2