Extracted

• • Target

    7e7e34a96b97e205c516ad2f70ef773d753371bcbd6549e56c466e2a7dcfae4dN.exe

  • Size

    472KB

  • MD5

    96f45b4bab3cd36f826baff920261b80

  • SHA1

    4a15c9679e283903c2a8b8dfd59b098505e5956e

  • SHA256

    7e7e34a96b97e205c516ad2f70ef773d753371bcbd6549e56c466e2a7dcfae4d

  • SHA512

    8af794553c6d9e1dfdb934436713bd70ff8092644e13689f43e0dad2117fb38ec5192b0164a0e8fd9631ab4e722773467763d29b3a0d0a7619a7c61d791505bd

  • SSDEEP

    12288:IiSC/HR7+iLb0Be5Wqp7ssBlRwWW6o6da:AiJJ7zBlRwSo6d

  Score

  10^/10

  cybergatepwenddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2