Extracted

• • Target

    b2cd4abd47a808f9709dcd24523e7e249641c67f4bb9ea1b99661a4a5eef4fbf

  • Size

    599KB

  • MD5

    6f461914524d3d2e8b1858cfab11d4e0

  • SHA1

    b43c131b81f54fdf8a9b38d56a17a1d40452c0a5

  • SHA256

    b2cd4abd47a808f9709dcd24523e7e249641c67f4bb9ea1b99661a4a5eef4fbf

  • SHA512

    39a78acd1e9e06680b15430d79b492091a4fe065122e444c4431a1c3c2b15d1306bfcfc11e3baba47c3461fc3cb34ee46ed095d6ba8bac1017546aa28c5e30f8

  • SSDEEP

    12288:A9eVQkTrvj4srOenbZ+gUqMnYwqp5sqU5oXtftRT9Furf:AUQkTf4AvnbU6bp/b5Fc

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2