Extracted

• • Target

    38fa567ad34b2d3045d54c1d2a74eeaa43d8e0b5ab9daca387f2e949ebc4f02a.exe

  • Size

    548KB

  • MD5

    d420214603e59ddaa826d75f0f6b4f95

  • SHA1

    310c1f6e17901a673b6a9d1fa3869ad2ced3bf65

  • SHA256

    38fa567ad34b2d3045d54c1d2a74eeaa43d8e0b5ab9daca387f2e949ebc4f02a

  • SHA512

    6cec5affac4058383885e9158848cbb9146034ba9e9c471114622693c7905d5b82f2251fb65fdefb37da3cdeba24c9c4ff4446a8153003a96cb3144b634a9329

  • SSDEEP

    12288:WJIWFvEVjgjYecTFD+SpovTF6kEQ2/ktFlrX0FwcxAeozydGe:WJIicUjYZT8Zv56LQHtX0FwcXFd3

  Score

  10^/10

  cybergatevicitimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2