Extracted

• • Target

    guitarportfolio.exe

  • Size

    324KB

  • MD5

    56817271884bffe78eedb21b9ef2957c

  • SHA1

    1ed0d1bb06e4b7b878f7d6e2a1b061391f308e2f

  • SHA256

    b88f359ef837d4a39e47375cc5d81ded93e9ff633aafbafd3391ecf2b4b4ba0d

  • SHA512

    e4e2a2a6b0f8a58ba202de6c4060f4843e77ba95aec0b97f9419df4da2fe06eb58c9fa70a94202400eb4b1183ec88a8c24d00830fc10335a0f4631b3cec8bdb8

  • SSDEEP

    6144:g0J4yY9zWIjr+Z+Nj6kMjJlzli+GB5u7qGmUIlk0wLjlpEBKlKpS/:r4yYVWIjrr1M9RlpC5uuGmVEflp9US

  Score

  10^/10

  cybergategringodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2