Extracted

• • Target

    09d1cf7172ff8687b99a574d904a615178f29377185357884aa65bfa9f3ac424.exe

  • Size

    463KB

  • MD5

    11570b04c116f27972cdd0a9bfa91b16

  • SHA1

    e94459ff26a2451ca15ead4032b7bd587c41902a

  • SHA256

    09d1cf7172ff8687b99a574d904a615178f29377185357884aa65bfa9f3ac424

  • SHA512

    47fad20eae7459cb24ccabd9ef45ac9e28bec27954618d9c29916b6c13e03eccbb8632fbe64843c44954563f3b1e910eb1e2bbde95c160f38a4da6ee35974681

  • SSDEEP

    6144:GlAMD0bSdyAujir88e0LLi2re8tnhrtaH7Dh6J27m7kgcOeiU93qZqscOPEElzp/:GSMD0bSdyAJveihIv10eBO7xlvn35UW

  Score

  10^/10

  cybergatecryptosuite_victimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2