Extracted

• • Target

    2301fdbd3e56fdfd342fc5c6b8d5a378973de588b655444e1d47638b3648c6f0N.exe

  • Size

    1.3MB

  • MD5

    d914a35c9c3e3758199bf70b4f3aec80

  • SHA1

    6d766cde90eb91bf3d7be12f1709afdc0abac151

  • SHA256

    2301fdbd3e56fdfd342fc5c6b8d5a378973de588b655444e1d47638b3648c6f0

  • SHA512

    6e64a863b51e503ad42647f789e3c6696d9c6a392cd864fde17cc0705422660f1cd7ffe3ab27df57c19b1933aa964070c275e404c26dfa839cf62f7eeed0e78a

  • SSDEEP

    24576:T6VSj50UyoE58rpKyP9gYQaH7+fB99K/cRgOnmq9g6omeG:Tv6fmtKOQXfB9mcOU7m6omeG

  Score

  10^/10

  cybergatex00o00o00o00xdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2