Extracted

• • Target

    27fffebd5233083f913f4fc53ab4ea012457d6d3c61e0e432f5f635285ef9abcN.exe

  • Size

    567KB

  • MD5

    de42ca9e1ad22c460d305ef53e2bcac0

  • SHA1

    6a16f6f68fe1aa06aaf1ceee6265c45bf1f56214

  • SHA256

    27fffebd5233083f913f4fc53ab4ea012457d6d3c61e0e432f5f635285ef9abc

  • SHA512

    fa4ad479f4a4c67e90a45c78c04d426a79eceae814bc13c724aec754288bc9614cb677f7d76a26b3c4f33c3b02d15c412878bb2facab28c7001272c4b6678cc9

  • SSDEEP

    12288:+HLUMuiv9RgfSjAzRtyJPcv35417XfM5Hr6DhbN470UiLJRz5:8tAR+Evj65i72LJX

  Score

  10^/10

  cybergaterxbotdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2