Extracted

• • Target

    0f662ef68551ab9d9c095d0d3fa474be9aa278036aa6818519f78203be5260fcN.exe

  • Size

    388KB

  • MD5

    bbca1a63f83cf46080a0690a04963350

  • SHA1

    2086263935cb4446c9ce2de25b488fcdc1a7b10f

  • SHA256

    0f662ef68551ab9d9c095d0d3fa474be9aa278036aa6818519f78203be5260fc

  • SHA512

    0a73f88f8a2fbd6bf8607d4d3e4acce1eca2b56f8cc96db6ffb4143eac735dd8ada0ba0937047adeea3de0d77204463829284d22cabb1a181960524dfdbe415c

  • SSDEEP

    12288:gJwBgI4j6WKeN/XmGR8c+ExLV18N6OjqOB7xOaDEpU:gyyH69eN/Wa8KUljqOBF

  Score

  10^/10

  cybergatedebilediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2