Extracted

• • Target

    c2d1bbfceaf0c4429b3d5497215ee6f5a66af40b461df2f2532f2406f2f5e0d2

  • Size

    1.3MB

  • MD5

    6250a4e8bd08512d2d3434c0801c0f64

  • SHA1

    e004a6918fa85dc11b91b451d451e870887f25b4

  • SHA256

    c2d1bbfceaf0c4429b3d5497215ee6f5a66af40b461df2f2532f2406f2f5e0d2

  • SHA512

    8e99363b2cc08ef56993ebc83e0f0f18b6723909bed242832d46211a1061f9248937e45ce0d1ee15d5c80f78c8dafb42396a3597c5f148a6068ae40985e35dae

  • SSDEEP

    24576:T6VSj50UyoE58rpKyP9gYQaH7+fB99K/cRgOnmq9g6omeC:Tv6fmtKOQXfB9mcOU7m6omeC

  Score

  10^/10

  cybergatex00o00o00o00xdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2