Extracted

• • Target

    ab9c3e608c8d019feef8168a6788e0889d8a562d0d86032b8a3c161dcd31b878N

  • Size

    907KB

  • MD5

    26ea14da98482ae649cc2c8bbb7424d0

  • SHA1

    9ec86f9604c780d916200487670377d3404ff528

  • SHA256

    ab9c3e608c8d019feef8168a6788e0889d8a562d0d86032b8a3c161dcd31b878

  • SHA512

    64c7468bcd63d210762918f1481ca3f68559248979ecb8f560c6848d61c82d29016cf9e483523a4978fe8bb860fdc9d38da56c5c37363a4f1b62447b15f46f61

  • SSDEEP

    12288:1HLUMuiv9RgfSjAzRtyey5fqBhoC6bunRiSzp0/du8VihHwTrr9AJZGeR3p+PD7e:9tARIkToC6qnL3qihHIKJZGeFg/e

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2