Extracted

• • Target

    ceffd2da30c7abfd65d82d3f4e682fb4d2560070c5c7b900dd98ddf5d5d42ce7

  • Size

    497KB

  • MD5

    f8144573768ca1b587047cf25fe41427

  • SHA1

    08dfbb5f0cbfd190f1e118dae08ffbe8c06c4903

  • SHA256

    ceffd2da30c7abfd65d82d3f4e682fb4d2560070c5c7b900dd98ddf5d5d42ce7

  • SHA512

    52fa04bc587abae3a76bdb93d1392be0459ee4ecb18e5340791f97421d272712aa18998b5f83a985908cf9a734d2ae846e01f4e3f6c62c15c178400c96f6f53f

  • SSDEEP

    12288:YjuUasMQ2hA/BqJ9EGqyxPuB78VEUIEnD5onI82CggNpK:OL3/B2zqyxyaEUIEnD5mNgKK

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2