Extracted

• • Target

    5087813ebfa48176b6fc67c1f5126bd159f2ed180c74fb832c3d6f426a40bf4b.exe

  • Size

    662KB

  • MD5

    3ff099ce85b4d0730540d4273444b8fe

  • SHA1

    933e66bb416e12d70deacf23c21aa75b197c11b9

  • SHA256

    5087813ebfa48176b6fc67c1f5126bd159f2ed180c74fb832c3d6f426a40bf4b

  • SHA512

    90d38b118b5b55bd0d372033d89b1af3a094827f00801fa0b2927fd02b2e56e3dd2e877c69db3fdf48d178f37c0cee1b81fd68cf9ffc15bc111303a60044657c

  • SSDEEP

    12288:43fQAnUFGBEJdWuLHfBGu68zEKtzKrcVPkCjuKjQhxFta6Ios1ZVzYKj86sMbw:43VqGBEJdWMJGuXzEKtKrmlWIos1ZpYB

  Score

  10^/10

  cybergateöííébootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2