Extracted

• • Target

    Eigene Bilder/Foto214.exe

  • Size

    464KB

  • MD5

    6c7217cd9be80c19986a94175f894787

  • SHA1

    13c21ce0588117420594d4a066452b0cf849e621

  • SHA256

    60c66e06998d2ec6fa6d18fb7dfa1da2f18aa0e11c0a614a5f957838f99cf429

  • SHA512

    b17a21be5e418c5b9a8c0dcd544ee7b6c8f84fa04e380e9b31d5a8278bcabd3ba276c2068eaeaf1612b12854cf53749d77b444c40695d9daf8aaee272760cb1e

  • SSDEEP

    12288:f2NRJ+Q0cE2JNYjIyYtE9cHpJJvacwlYcPqY:AJlMqhlf

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2