Extracted

• • Target

    ba3f772cbddb0b0e49a2efd7a31c22050b1f91ebc41350f4337902fd54d311a6N.exe

  • Size

    322KB

  • MD5

    f0ea706a96cdd78e03dd58662bdd9070

  • SHA1

    c68fd66b245f9b8491c94e7b6255866b2f82e8fb

  • SHA256

    ba3f772cbddb0b0e49a2efd7a31c22050b1f91ebc41350f4337902fd54d311a6

  • SHA512

    f5e59156e86ccb515321b912423e51447ef2935c7402e408a065d2e00bf22cb135fdb46e0e766892019d36acb5c9aebf08bafdc2232d407d088b1b32567c5f86

  • SSDEEP

    6144:Fb3VaFaBbLwKB6bndfpyxQ/lM1PZ+dFDW26btw6SyksgZ3i8gi66pj6+IjY:h3VaaBbkBbnb/M+Lj6JUtZ3i8p/wjY

  Score

  10^/10

  discoverycybergatemon victim2persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2