Extracted

• • Target

    fotosuploadcominfidelidadfotos22deoctubreparaquenoquedendudas.exe

  • Size

    376KB

  • MD5

    eb97898ee23112c654d62acb30bb98e0

  • SHA1

    0a823d5a86d1090c6410085f90144d34c23a60d4

  • SHA256

    fa140dd66eb1fa1dbd5646d46d4c848c5209d8b1c2547f238eacdedc2864151f

  • SHA512

    9f188197e7096dc4ae8b117c2c0813b522234777079c194008b37252ef79f3005e631408ea17c99b837313d2588c1854e9e279822fc3141a8a10a3305ace6ed4

  • SSDEEP

    6144:/PhkhpP2uugBXw9eNoahA3hfUQKw/muXFoC2TZtaVX5K:Hi7u9gBXZoaGhsA/H1CTZa

  Score

  10^/10

  cybergatepalantefinaldiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2