Extracted

• • Target

    89058b5929520f99c78f122ffbc31c9b61ab24c09bc51a6817d073322ac24f5c.exe

  • Size

    276KB

  • MD5

    1676455215656965600cc7d72101758f

  • SHA1

    44315791fca79ac39152200fa80c1d27fa4967dc

  • SHA256

    89058b5929520f99c78f122ffbc31c9b61ab24c09bc51a6817d073322ac24f5c

  • SHA512

    acae8ab31b123dfb8b5063b3ac7292967bf42ca1690c57664a427aa5ad8f673dd2fdf4e9ffb3d6086a83cdc5a9168a290f62deb89d2688766709cb4c5dab7e3f

  • SSDEEP

    6144:2k4qmxDAYW5htrxg/32wZVzbiJJYf7tqwZUQDkvY5Ls6:J9+whtdwxz+4Bq3vYN

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2