Extracted

• • Target

    c66bf31706c93a7313be566b9241ffbe1b83e7ec0475b1116174bec86d03b951.exe

  • Size

    655KB

  • MD5

    00057d28eff40c8b8ea6998868bd7447

  • SHA1

    a8b0cfe1d36cf37d85cdce33e5a147aa1e1a1e8b

  • SHA256

    c66bf31706c93a7313be566b9241ffbe1b83e7ec0475b1116174bec86d03b951

  • SHA512

    38d3f0f2a848ba4d47ebb9c120b29c3f5b40bb9fa0ae5e2c0ef356cc407dab7cbf0b322fc8ef9d2f7e6321a1b2ef06cd0dd1c00f7666b12f293076c05ede7bed

  • SSDEEP

    12288:TBMmKGnhDT+JlCraEFmgssC2m9cwx+qdTC6AkQ5yaT3Og642Y+SfL:tMmnDC+rPnsG1F64tT3YX8L

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2