Extracted

• • Target

    d0163590a8786722f8431b601c8adc1d9763673dc031410d7d11c662b6e832fb

  • Size

    276KB

  • MD5

    7a36b02d0b6184edf02a66ff8f488660

  • SHA1

    e616238c7afe137427cf2381cb92dc6f14b47a80

  • SHA256

    d0163590a8786722f8431b601c8adc1d9763673dc031410d7d11c662b6e832fb

  • SHA512

    ff4c61800b67d4b04df95271760b6a1562917f3b9dcfc1d8cbb06473616c4db651fb52a680dbe6e7c9832f18facd4cd6e4940d442b4ecaba77ef9af7a1abc80d

  • SSDEEP

    6144:9k4qm9YbafFlNSGBUZvHEkoE2Z1NoVROKlz6/kiM9EJ47Q:q9ANSA0oE4PoVQKlOkeJ47

  Score

  10^/10

  cybergatetimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2