Extracted

• • Target

    e72858efbed6a5191b07d1745ead8400826fb5ac202f0f628c5e627af0a2ef02N.exe

  • Size

    410KB

  • MD5

    e381cf091afb575f72e2a118dcc5c750

  • SHA1

    49098487b81012c864cdbb58c59b65b4d664613b

  • SHA256

    e72858efbed6a5191b07d1745ead8400826fb5ac202f0f628c5e627af0a2ef02

  • SHA512

    7c0c0e23a72ea7fa311c241fd3faf12c5404e5d194ab570a4e92e9f7b3655d3bde5c70bec37df50c3827c421275952b0f0741db8b1368987344d7bd63717643a

  • SSDEEP

    6144:VC8sO0LAvDoaldldCArCFISS8WTxLSGYHNmJP8fIuHh9m:VC8sO0LAEV5nS5xLYHNmx8fIWm

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2