Extracted

• • Target

    c77899a563ce3571fedf6d025e62dc14de7f928d66733464705cc74b53484a86N.exe

  • Size

    3.5MB

  • MD5

    51126f608ab8a9d5ecd8aaf46aad4cf0

  • SHA1

    3c2d40c2e66d8de4dfbec3b702523c137dc3012b

  • SHA256

    c77899a563ce3571fedf6d025e62dc14de7f928d66733464705cc74b53484a86

  • SHA512

    c8d4baddce9a387f8e53cbfb24cbf260978779b021af72bd58b24936bb8acffa1443d71faafdefc70ae8b490973d8e7110d065aae9a5bcb20a093e8c681c46bf

  • SSDEEP

    12288:KJ4VPrzIIX06bgsZAyzcxNkekx7GNEnwQsEdUqJahKi17qGCIMNTMefl4z27iqLC:rVvfshku2tsEVJsKsnVefi0zRUwcH

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2