Extracted

• • Target

    70146f9d7d3b1ce308002989f3c36ab5af82f688ff65f615405eac0a87e9665bN.exe

  • Size

    756KB

  • MD5

    978336f1153ba929e77796da74f64470

  • SHA1

    2497317a7f475f60da9deac6c0073a697d1a44b5

  • SHA256

    70146f9d7d3b1ce308002989f3c36ab5af82f688ff65f615405eac0a87e9665b

  • SHA512

    8972c82f18b9628fb0c0b0040d1b18b0833f031a8673c4ad60c711ed7eb6df8dddabffdee9bcd411f2fccf4a909d815eca9125e53cf52957caf4403e96376d66

  • SSDEEP

    12288:m1iq/ujdrDqfnDqPoM7yowPeLddpNa/MKyJfVK20+K6UQ/ReRxBbDMK:m1A4f4+owyxb8YhCrj

  Score

  10^/10

  cybergateluckystardiscoverypersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2