Extracted

• • Target

    76fc18247970b458964c60ca63cd208f77dd1d43513390c355d3693067197bbd.exe

  • Size

    1.0MB

  • MD5

    902456c0c50438c690ed9d7cd1a12cbc

  • SHA1

    72584fdcb942252d7e628dd07340d756c243a562

  • SHA256

    76fc18247970b458964c60ca63cd208f77dd1d43513390c355d3693067197bbd

  • SHA512

    9d41a36ae7dc6aafea53c4d9eafa7a7d878a72c91996337fd33b7637324edba73b392894e76f9442e2e35e24414a9f1231945a089c3a33d568de3238d4c1a091

  • SSDEEP

    12288:LLkcoxg7v3qnC11ErwIhh0F4qwUgUnyjP3xSQG0Qp5EKdKwI8MW9mnfE:/fmMv6Ckr7MnyjP3xSQUp5EKgV8MFfE

  Score

  10^/10

  cybergatespmdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2