Extracted

• • Target

    aed92a8301931959100a1bb8c52251df2fdddaf8b76ab34b6f24d7bbe58a4fe6.exe

  • Size

    283KB

  • MD5

    77515669c23c08469a95333a8d43be63

  • SHA1

    2cea71874e735ab23b2580b03e0afadbbadf0bd4

  • SHA256

    aed92a8301931959100a1bb8c52251df2fdddaf8b76ab34b6f24d7bbe58a4fe6

  • SHA512

    9b10ae0c4b02512b9f0e9b35fb5b1a5a323545be80c241e01519a4781f24f50609ccc2158e63e09c59c2820de9e37e06301c12509e9133ff4f62976293860304

  • SSDEEP

    6144:jmcD66RRjf5JGmrpQsK3RD2u270jupCJsCxCC:acD663eZ2zkPaCx5

  Score

  10^/10

  cybergateiddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2