Extracted

• • Target

    cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2N.exe

  • Size

    296KB

  • MD5

    6afb13c14bf63d663dbe88d7f1fe0130

  • SHA1

    5e707443dc8dfc126f443fa405af457913dec921

  • SHA256

    cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2

  • SHA512

    e8d4adb40dcc6291c5eec5af649ac1f3b1c38faa398d8e76617c5bcc29cb2f449554ade6c6daf1f35505ada83c86d9fb473e5899d8bccb814aaa1e931fed2bf3

  • SSDEEP

    6144:POpslFlqthdBCkWYxuukP1pjSKSNVkq/MVJbf:PwslgTBd47GLRMTbf

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2