Extracted

Extracted

• • Target

    Dealer police Journalist & PL rate reveiew.exe

  • Size

    656KB

  • MD5

    26ee650364f056cee6a1e7c0364d3daf

  • SHA1

    31de83d98c3c122184f50191b3a92ff08cde62b6

  • SHA256

    be744439745584f2cd78738e2583a1ec1c795181e80d10598038355fd13ca2d8

  • SHA512

    1800a2493d453b769939b9cce4492cc4187094fdfdee33dc37f0af7a5422c4d7a3f6ce67362e78d3b01418f891803cf03379b3e26fa035f587c3960aeb060887

  • SSDEEP

    6144:KNb50OmlvbRzpv1sFZBPGVZkroV18HBaza/9NkS2JQNuG3fabRoT:eb50OmlvdzwFOyMV1oBaUN2y8G3k

  Score

  10^/10

  cybergatelatentbotcatlogue1discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2