Extracted

• • Target

    7e12c23b447ed9779639da02f091ffc2a7b8e8bb8707fe4047f32257eff19175.exe

  • Size

    5.5MB

  • MD5

    410151663cf12219c7de2ca25665b9a0

  • SHA1

    06481c99020248c2b895ac98de73992bece1d7f2

  • SHA256

    7e12c23b447ed9779639da02f091ffc2a7b8e8bb8707fe4047f32257eff19175

  • SHA512

    874c65ece8d79752e5354f9c29c230a288ed2254d0a763f393f422c25e822b49c415721aeb70cfcd52fae7f21b37ca4d381a8b5e822953d23c426a63fddd5352

  • SSDEEP

    6144:+eWqPBZKGF6Dlwyi4iIE8CuBVWQZNMrr63jaWAV5/f9oHtvY:TPB8e6p+IEh6fMSOxV5/f0tQ

  Score

  10^/10

  cybergate2205discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2