Extracted

• • Target

    Installer.exe

  • Size

    88.3MB

  • MD5

    0418987044d55002fae307e64f216fd5

  • SHA1

    dde600f2557245c341592861e8dc5edc2ab1d81a

  • SHA256

    f2cb1001a9c0936aeaa60a168a141101026f065ae56293efe870849dcaf00f2d

  • SHA512

    695d636db0dca776d8fe42c1f7c4b0201e269d975401839008f2ddd090557ba46a5f869af799c0e1dfdead31ca02eb8346f1f108cb5bbb52483799ac7a6c2f03

  • SSDEEP

    12288:BvSIxjf84CMJNmU2UcFrI4t7OPBnAX+U46:Bqcf7lN6kAO+Xa

  Score

  10^/10

  cybergatefeddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2