Extracted

• • Target

    671b5ca0ab77618d9f846d4ad2b27b9f32ac0786c4cf7b7bff0b602596b3e929N.exe

  • Size

    1.0MB

  • MD5

    af5d8e0eb024528218327409f94e70f0

  • SHA1

    ca08a96cd17c1ac03edb02db9e9389ec63074aa5

  • SHA256

    671b5ca0ab77618d9f846d4ad2b27b9f32ac0786c4cf7b7bff0b602596b3e929

  • SHA512

    a618cdecaa38a95ccd144f990de4809ef3539698a899c7588b2c31ee826b8687152468ff97d77be9dfb7fb86a99c99889e2e723755336caa0b445415a2b757ec

  • SSDEEP

    12288:LLkcoxg7v3qnC11ErwIhh0F4qwUgUnyjP3xSQG0Qp5EKdKwI8MW9mnfc:/fmMv6Ckr7MnyjP3xSQUp5EKgV8MFfc

  Score

  10^/10

  cybergatespmdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2