Extracted

• • Target

    98e2cc678cde1fa4db85052b9e79d7662191b7d9a90baa57cd405394caf69aa1.exe

  • Size

    339KB

  • MD5

    9306ce8849641138ac4749e1d81b707c

  • SHA1

    21ecb6a594b90d6cf2576f18604ec88d7ea6a74f

  • SHA256

    98e2cc678cde1fa4db85052b9e79d7662191b7d9a90baa57cd405394caf69aa1

  • SHA512

    25e1682710a4a9fa921a58ab8115790f126071b79cf3128571e73da853ea9eec04ff7fe8370b30b5229e6546a555369e41ad994396b9627e3838af8565fc23d7

  • SSDEEP

    6144:rxL3BJmt3/8DhQjpzLZNqN3jPg0p/HTEZm70azTQIHXCz45:VrOx/8DhQlzLZNO3jPg0+Zm70yQkae

  Score

  10^/10

  cybergatebummdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2