Extracted

• • Target

    75fd2a6c8e93491812add90285e993afb9340d66291064d254b7c1dca2f2966d.exe

  • Size

    334KB

  • MD5

    bfb0045debb7ebd80756782cb2700806

  • SHA1

    49d5d703595239933288d2c80684bc95dd6ebdad

  • SHA256

    75fd2a6c8e93491812add90285e993afb9340d66291064d254b7c1dca2f2966d

  • SHA512

    f3682b01c0d7bf2d422615712bdd46676e3ab8d9be553300d8047ef0fd9dc8eb39cb6dfcffada223e24e140270c5e9fe5d15b811f454e4a29f69c83a345bbe6e

  • SSDEEP

    6144:QGV8r8IFXNhc23rLD1cAA25JtURpwi03gI/qBisAqz:QFV02bLD1cl25JtUu/qBiN+

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2