Extracted

• • Target

    Install.exe

  • Size

    7.3MB

  • MD5

    90e0374d53bd364405bf1464ed43aa0d

  • SHA1

    b137ae0ba73dade97e754e794b8482bd140503bd

  • SHA256

    d6568832283a943d8cfd607efbf7e8036388ec457c2193a4525115718a2b5b8a

  • SHA512

    23aa834cbb6b02ebb8011a6d27dbd8fe68a3eca1cba5a5ffd05eb794685edebf6fae19a20b8e93759c290677b5650e792a49c5cfed1867b55b3f42c5045cfaf8

  • SSDEEP

    12288:wraNNP1wmNfnkh9LJMFr2RnvXbdrC/bT5eVZOHE:/NIl1rdq0m

  Score

  10^/10

  cybergatefeddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2