Extracted

• • Target

    ed88eeb3212ea3baf8ebf60fcb757f662040c24ae8325c1c752dbbe12f753684

  • Size

    289KB

  • MD5

    e65b6594a9a1412ec2f04abcd4291e4c

  • SHA1

    3d9f7b0e8e93052cd9686278f8d77a91356a2001

  • SHA256

    ed88eeb3212ea3baf8ebf60fcb757f662040c24ae8325c1c752dbbe12f753684

  • SHA512

    f1e7c8dfaf88f4afa68d1566e699b2b2006ef0864e6ba6f5973250a43832234e8a0301f958e6d0f407a9168f9907e75d6b56dbccf5c8a47c3e42f022e5c94e95

  • SSDEEP

    6144:GOpslFlq+hdBCkWYxuukP1pjSKSNVkq/MVJbj:GwslrTBd47GLRMTbj

  Score

  10^/10

  cybergateosamadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2