Extracted

• • Target

    Terraria.exe

  • Size

    678KB

  • MD5

    fcb443f5bfa48c387991736e6b2b5803

  • SHA1

    8195908b47c087d4b1c5abc198632ed26a890d23

  • SHA256

    d9325fb197488e9c06adf56c45007cce94f403e5e0f444229119b948cd361d78

  • SHA512

    c883116976c01c9d1ec583f3f6748522833dc199307b6e2812ded179861193b905177f82cdff7cb7f741ac4a4976f35020a0b1a54959a7c310c003b63986b889

  • SSDEEP

    12288:ldqhhwtMmi8PHsyA50a52usAccoJe44QAVm:ldqzCMmZHsyeQA

  Score

  3^/10

  discovery
  behavioral1behavioral2

• • Target

    test.exe

  • Size

    275KB

  • MD5

    477b2b8d24e316c8bb3282983deeb292

  • SHA1

    86f16f72ddf9d23d2205a73b9c795fe4c260e3dc

  • SHA256

    6090f28960bab93657d958946d096874307422eb3497f02d30dbb2f9e5690e3d

  • SHA512

    b34aad4936df83467837a96120223059ef35a79299ec8876db66e31b7202a8482e768ddc7ac77f02f5346b4461fe6a30822089fda180e89d73441e83ffc9cf6a

  • SSDEEP

    6144:FMILuveX0F0YPXc8wJpEDvg8o+JH2cO6x8cO6kCz:FbgeX0vXCpUgFQH2f6xdk

  Score

  10^/10

  cybergateksama_pepitodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4