Extracted

• • Target

    e471a004fb00e3613d29fe43f0c56767125de9370c70e2c811e991becc5c8cff.exe

  • Size

    599KB

  • MD5

    ecc28b28ac789a3572a4bb6aa860265f

  • SHA1

    436a007de3068634684e8ba5e590d393e2244a19

  • SHA256

    e471a004fb00e3613d29fe43f0c56767125de9370c70e2c811e991becc5c8cff

  • SHA512

    2b1bcfc59f7e9a119e9e96b69b32fc369bee966fb886ee4efc43d702dc0d0959c0c36dfa34404127a4a0d8d98d3e80d7addca2bf4872b81ef1c0fa4012e7cb9a

  • SSDEEP

    12288:A9eVQkTrvj4srOenbZ+gUqMnYwqp5sqU5oXtftRT9Furd:AUQkTf4AvnbU6bp/b5FE

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2