Extracted

• • Target

    bfa0d07a1300bfe1cdcfe006a5212fc1c09912ac6edc96d6954b88666485246b.exe

  • Size

    296KB

  • MD5

    4f66eae24504c88e93269791399b6df6

  • SHA1

    ea5bde4dffee7f95acbd6ec0d2d015fd89a34e8f

  • SHA256

    bfa0d07a1300bfe1cdcfe006a5212fc1c09912ac6edc96d6954b88666485246b

  • SHA512

    d0e1ffdfb7c5fab064a90a50b3d741313b6520854885ff489b4013a0b1d01b623cfdc45196825a33e18abf35b52cfef79c2a96c9dae1069eb368b9909659ea23

  • SSDEEP

    6144:MOpsl8lqXhdBCkWYxuukP1pjSKSNVkq/MVJbw:MwsltTBd47GLRMTbw

  Score

  10^/10

  cybergateremote22discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2