Extracted

• • Target

    d2b90038bf62e800a548d1e52e2ec7a2e767ff3ff39f50ba6288060323b34828.exe

  • Size

    264KB

  • MD5

    f180f07f084acf3bcfc24fe6a302e3e0

  • SHA1

    523e5c75f85d6413b7db040c85dcd22f0cf70b19

  • SHA256

    d2b90038bf62e800a548d1e52e2ec7a2e767ff3ff39f50ba6288060323b34828

  • SHA512

    8beb424921479a76ce16b734275ccce23383960fa18a471dddb0a21540653310cf59ee94f2cdea24908066213076328389f1592a8e4b393788603b1839e7ada7

  • SSDEEP

    6144:vkkoT4g6k0DpqRhteXoKa8EZgcm9rEYIF1R8IOloVf:ckekk4sEoXpcr2VtVf

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2