Extracted

• • Target

    Facebook2.0c.exe

  • Size

    657KB

  • MD5

    bb13c7c11a06938a3712fd28ef02d120

  • SHA1

    01dbe675655daa6d76ca794d7be07c20d4aa4460

  • SHA256

    81ed9a4f70e3bb1bcffbd63ed9db3d382ef90550d60987211e55e4812d523a94

  • SHA512

    10b4e536f560da0c6186b9b1b9abfa9142af24106b134776009abee27c1ac7ad500b406b29c7c087791deda0f62cc97b08968ce497691f7db85fc946f09171bb

  • SSDEEP

    12288:lI/h7cayNP2zaR8A5+nzSN26WHHnchTEN8g1FWmV/h7HZyf0LS:lI/h4aC22+zSQxHHyTEt3V/hu0L

  Score

  10^/10

  cybergatelightdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2