Extracted

• • Target

    2fe46191358d59fca0bade9268b8517fe4146af224a095e9cf9e9deeb8f3c3d3.exe

  • Size

    2.7MB

  • MD5

    3e2b65e524e90c30fe0e5e1b0554acc9

  • SHA1

    1a53c2a6e8f97d71ec45e01d6e7b748ae5e09bcd

  • SHA256

    2fe46191358d59fca0bade9268b8517fe4146af224a095e9cf9e9deeb8f3c3d3

  • SHA512

    2cf8b7139199458a597d8ea6e1dad25462246e95d82fcf5a80582e301fcc0d292cb29ca702b53ab5b7f9fe87e44f1bd40042a4dd80d5e0a116dd7377080a054e

  • SSDEEP

    49152:7UU8YuHT7TWPH+ERuznN/3WnpcVGDMb1K2/8vrYaKa8:IYuHT7TWPH+ERuznNfWyVGDQFWKa8

  Score

  10^/10

  cybergatebat1discoveryevasionpersistenceprivilege_escalationstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2