Extracted

• • Target

    d678d0f771784b26009584fce4d21696cb275a5ae7994e104b25fa2382b61622

  • Size

    284KB

  • MD5

    c716367a1771cb09ada30f56d3ca54cd

  • SHA1

    3bb7123c13b84ff81d20101fd755efcc705f3a89

  • SHA256

    d678d0f771784b26009584fce4d21696cb275a5ae7994e104b25fa2382b61622

  • SHA512

    a876447d41ba27c4103a86a4858af3604d5ad52310cf4229bbf921c84188e827f61183cb94d99f5e5d206995702a1e97a87beebe31a452432ad464ae1b1e3386

  • SSDEEP

    6144:Bk4qmkG62H1fy75z2ipU8yiUR7NT+OUJR96t/lPC9Q+iha:W9N5KWKR50Jr6/yQDM

  Score

  10^/10

  cybergatevictimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2