Extracted

• • Target

    27414e10f2d5f5538ec8754724c3646a8a6bae1ba74f0975075a158ac3f7fb02.exe

  • Size

    296KB

  • MD5

    cb627ae3396f2171d17acb8e37bf900a

  • SHA1

    cfb35b5f3b24c6cd8b0b47d61b59f124cf61c8e2

  • SHA256

    27414e10f2d5f5538ec8754724c3646a8a6bae1ba74f0975075a158ac3f7fb02

  • SHA512

    c06fa960a7084fca643e674a9194e9a37206be4ad7189e704f8c3bce74873b7df5c5b14dedc45ce4a00000ae11451ccd2e338cdd3bb9d97e75015746271f9ede

  • SSDEEP

    6144:POpslFlqthdBCkWYxuukP1pjSKSNVkq/MVJbt:PwslgTBd47GLRMTbt

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2