Extracted

• • Target

    221fe1191aa3e768a11f14a78a58b066646e0e2cf46d7ef2ad496b2564c874b1

  • Size

    5.3MB

  • MD5

    4e03b1ec179f49432b8dc8e850e9eda0

  • SHA1

    6e3a3ef9693fe639963546ccc5138b61a2b68c8a

  • SHA256

    221fe1191aa3e768a11f14a78a58b066646e0e2cf46d7ef2ad496b2564c874b1

  • SHA512

    a68b101817f1a94ccd409eb3ad656836e586c5efd1d5e26859de427f5adb279040ca6e6b2da8cb394083709b0610e6a3d867a7d9ff65f8176ea7ea3b71af7e63

  • SSDEEP

    49152:gh87j4aV9kcbHsIiAhnJ+bYHcxbYLOojcsbVLsOIONDv9GP:Y8Ias

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2