Extracted

• • Target

    d5103ba8867a0a626fa0836b178e019a1b9f4e28e3e12784b73bab3838dd6d4dN.exe

  • Size

    296KB

  • MD5

    f5178c1f53d574a809d593bf2f21deb0

  • SHA1

    a0670cf3b849f7681898f08e057202acde0486f1

  • SHA256

    d5103ba8867a0a626fa0836b178e019a1b9f4e28e3e12784b73bab3838dd6d4d

  • SHA512

    1b8facf13970ac1557ddb54f99a7900e764bf849162120a6e499d274a3ca9329741e3f50bc432b863b0b66f11f9237bcb0f97404886ef46b2d7ebb0fc5c2cd56

  • SSDEEP

    6144:POpslFlqzhdBCkWYxuukP1pjSKSNVkq/MVJbK:PwslKTBd47GLRMTbK

  Score

  10^/10

  cybergatepihikdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2