Extracted

• • Target

    a2a003f9df3b1d412ee10213b2761f94a9f17e4351d6d03c543b11eb084ca0c6N.exe

  • Size

    484KB

  • MD5

    af088a1462c5609be5a03612e99f9bf0

  • SHA1

    8e45c364a6f5a006d628ff13b163f6784f55eda6

  • SHA256

    a2a003f9df3b1d412ee10213b2761f94a9f17e4351d6d03c543b11eb084ca0c6

  • SHA512

    1f059735075156c3778db29d41e5e30abdd5dad6ff038184112962e42ecee9de88145819e727cfd9a2b3d66b5ba2e43ac59bfb6c5390df6d4b23646ccc978ef3

  • SSDEEP

    12288:fRoDLKIX3HgugB6k0C1hBBLaNVigTYVZ3:O6IX3gugHBjgTYVZ3

  Score

  10^/10

  cybergatefvaleriadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2