Extracted

• • Target

    ad5d65f42f9e6abdb21c0477fd5f144f671c3cbc50afe44bc80157fce2180e4bN.exe

  • Size

    500KB

  • MD5

    cab4bc75133bcebcebccaa01a7658870

  • SHA1

    55e0b36caa0b91bc0add4f6f3d590b19ea0210cc

  • SHA256

    ad5d65f42f9e6abdb21c0477fd5f144f671c3cbc50afe44bc80157fce2180e4b

  • SHA512

    4d5703e880845f35f827ebd04c0161a557f7b83e67e26432e5205e2402df2ae48a381431080ba36d2b9925db43581d24d537bde561f7ed89e6e195df6a440ad8

  • SSDEEP

    12288:Bd4mTPtp7Xzc4Jjez6wHhXn9bDZtAwuHlo4m12XnC554uwy:BdJztpfc4wuM9bDjAwUhM2XyauN

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2