Extracted

• • Target

    Paypal.exe

  • Size

    448KB

  • MD5

    51f37d7d561241728a76c2d464155b5b

  • SHA1

    a8a65e0cd5eb51ebd7c55e2822f94cb75cf7254d

  • SHA256

    3f1a2c57849f1182cc9c53171a32989714ff556a02c6069c41be22ab012aea06

  • SHA512

    735c42bf3930176233dd2b30af66843117056ab7eee86842e58f588ca82104e015d077e7a7c0ba270f710b92081877927e3e33c6c1ea3cd4f96575e87f853f02

  • SSDEEP

    12288:dULgQAHe8fAIwgw4lAAx9BhmroAiEQAHe8fAIwgw4lAAx9BhmroAirGLyWSKaASo:dUgHe8fAIwgw4lAAx9BhmroA7He8fAIe

  Score

  10^/10

  cybergateserver_discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2