Extracted

• • Target

    75875a9f760524cc6a118350651d4e1210d0c31a7fa0756334978742f9c0d5d0N.exe

  • Size

    333KB

  • MD5

    e21dab6595add35014ee16df494db800

  • SHA1

    3bfebc4dbc07d3ce1ba76eb7f7367c908cb73b0b

  • SHA256

    75875a9f760524cc6a118350651d4e1210d0c31a7fa0756334978742f9c0d5d0

  • SHA512

    2befa47dbefce66510ef52787bfdea6ae9bb62ae3334bb96ac44ff126b02dd352602a6093eb55ec1d113e8b9e3e1a6577b2620306d07d88f87a65e9076071d72

  • SSDEEP

    6144:L/mnM9/f5m2+eZfz55GaxDRT/xmphUsjLlgVzJB4i9d9MQ61W8p6Kkr:Lunyfw2+en5zF/xmp6sVkL4Z7kr

  Score

  10^/10

  cybergatelukasdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2