Extracted

• • Target

    e7029596f42bee2070af35edff4342f2b896387704be6f985b9c4dda00d71c28

  • Size

    3.5MB

  • MD5

    9384920605f5e1a4405950e41ae6c08a

  • SHA1

    d3585b61b65b40ebea41df764c60ebf2ba0ecf28

  • SHA256

    e7029596f42bee2070af35edff4342f2b896387704be6f985b9c4dda00d71c28

  • SHA512

    c1010880007d751d420822adf9d9f2ea06853a5d496fd8e7b7aee708b24db25151819faf1240d59ae21c1fc6f141e445eed4c8f632c69a56bddabf41a12c3182

  • SSDEEP

    12288:KJ4VPrzIIX06bgsZAyzcxNkekx7GNEnwQsEdUqJahKi17qGCIMNTMefl4z27iqLu:rVvfshku2tsEVJsKsnVefi0zRUwcp

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2