Extracted

• • Target

    c56fa4e2195ae25719d7eb9f2d8d9e04f12ba2250dfc1dc2190fd8b180f0b5f0N.exe

  • Size

    2.7MB

  • MD5

    b55882231d4ae689ef2f437474bfcd50

  • SHA1

    494c885ab75defe799e9ba46def362d571112564

  • SHA256

    c56fa4e2195ae25719d7eb9f2d8d9e04f12ba2250dfc1dc2190fd8b180f0b5f0

  • SHA512

    58ba7fcd5f75d4ce1042ba28b66caba309e7cac9588e26b5ad36b70054004dd83673cfe6d903fdea499c9f2ff1e8e800285d8ef54598fe71a1c0339f0387ebb2

  • SSDEEP

    49152:7UU8YuHT7TWPH+ERuznN/3WnpcVGDMb1K2/8vrYaKa8:IYuHT7TWPH+ERuznNfWyVGDQFWKa8

  Score

  10^/10

  cybergatebat1discoveryevasionpersistenceprivilege_escalationstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2