Extracted

• • Target

    275778d4ed6e4798c4e523c35c6bf2bcf403a872a7dfc3e748191faf8e67ea79N.exe

  • Size

    746KB

  • MD5

    d1ec6694c9806c6a41898c60dd084030

  • SHA1

    b620252f74a58803431f0430f9942d32ed96e7ee

  • SHA256

    275778d4ed6e4798c4e523c35c6bf2bcf403a872a7dfc3e748191faf8e67ea79

  • SHA512

    95de98f1260712136386399e3274e8e01f647d7611b7350e69c38ec5a717a9f98f27e2f4f16c83549f85b1a28e76c9665a9ecff1f36276fd85a6ac9cfcb9a032

  • SSDEEP

    12288:3e5Pcc8f3JNzNwEhQYNk/TUQengaFs//Vgs6+VFjPAR8zJDEu577sAc7Hr1Fhr9F:3eSOM+VkuE7HBrYYZ4

  Score

  10^/10

  cybergate0discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2