Extracted

• • Target

    12aae6d43bd00772839b1fbaad7534ff3130ca6057878ee85c735b9ea47868bb.exe

  • Size

    282KB

  • MD5

    d4aa427d24195123d382df60450166f5

  • SHA1

    a95367dd9e0d365fe365cedb98a369594440b903

  • SHA256

    12aae6d43bd00772839b1fbaad7534ff3130ca6057878ee85c735b9ea47868bb

  • SHA512

    242d1ff5b16fe26ec3e98b070647d7f7ee9d3512ae53aa04fd1d7eb16168a28bcf1fe1ea81f45b427e95b5ae729c56c57fbed368bb7d96d2d9b63a6155ef5b3f

  • SSDEEP

    6144:FxJsGLnfoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZS:XJsGr4h/xQp6+tqOYy9zo0l

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2