Extracted

• • Target

    edc9ad9b9ebb530c92c74eae5739584f28592bf9f5e69000c3fb2ebe1777aecc

  • Size

    319KB

  • MD5

    53f8362ac1be66a1a40b851b3fe3633c

  • SHA1

    188af4ceb7182266ff5acd66bac693b49842c900

  • SHA256

    edc9ad9b9ebb530c92c74eae5739584f28592bf9f5e69000c3fb2ebe1777aecc

  • SHA512

    17343a24c781067cf9a2640edf4c30be0700c15c029310c59b52b30e806ddb837a38e69d1822d2ccf5c2f22f33184fcd213313b7226cbe6e40625b85893a801a

  • SSDEEP

    6144:jwpfGeJ2FpuDmNl6jI86yyZmhmMCY2fFLrDn8EtNMTbnXhFbE8g6ZBITTAjqVO:QOfFn/gI/zZmhmlY29Lnn4LhFlTETTAN

  Score

  10^/10

  cybergatenominasdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2