Extracted

• • Target

    af916d9135bc266217199f1347986d2d2ccf32289963daa4476c1ad669f74565.exe

  • Size

    567KB

  • MD5

    2adea1bdf1fe2bf69ac401726158000a

  • SHA1

    dbc1bdec11c78237c4a624771893028360800d62

  • SHA256

    af916d9135bc266217199f1347986d2d2ccf32289963daa4476c1ad669f74565

  • SHA512

    6d2d0c34bfa524bebe10c446057bebaec3d966f5dc878bfcd5a94c79fa2070c1c490fa4137ce5fb59cb89442b292d2659d9399650c80e8ce74f245494e37fc8d

  • SSDEEP

    12288:+HLUMuiv9RgfSjAzRtyJPcv35417XfM5Hr6DhbN470UiLJRzp:8tAR+Evj65i72LJn

  Score

  10^/10

  cybergaterxbotdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2