Extracted

• • Target

    fotosuploadcominfidelidadfotos26deoctubreparaquenoquedendudas.exe

  • Size

    377KB

  • MD5

    77aa4043bfd871ea44beba818098926b

  • SHA1

    0c7ac7c43024b4550125d1110b3e2a812612f856

  • SHA256

    f67fd3b03f8fe689c97bf04992b4ce197f23e4c99f8c020069fbbc5fb6456470

  • SHA512

    1695a12a6688e1863e92e71acaacfd695a0878e13e795b148ab62d8613a0061c0c5b8ad022a9e834eefef41f8f320f53fbf2e55c4e0e7da69ac8f2051fa5ef9f

  • SSDEEP

    6144:zzhkVBP2uud6KSc4+xgt+id9RVFlwfTENX8QBu5Tx+UEzsngpWwM:viHu9UMeRVFlwbENX8Q0b+Up4

  Score

  10^/10

  cybergatepalantefinal26discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2