Extracted

• • Target
    2026-01-17_f68adbf514f161c38dedcc53d91f62b0_amadey_elex_smoke-loader_stealc_stop_tofsee
  • Size 9.2MB
  • SHA256 7abb92d48c63a8acfbc0fc2b5019363e5ff8ffbb461ff8080c7386c1abf883ce
  • MD5 f68adbf514f161c38dedcc53d91f62b0
  • SHA1 480841091155f684c77e33b21f9d7af90f82b46e
  • SHA512 71d647789169559ad2f1792e3cf18431931493308e8903e3ae230e453920edef0d288e714d04ec927e5e9d200c35513acb5a330ae322c48c369e78aaffa5d835
  • SSDEEP 196608:by8RnYmcaK6vCUuENKXrtwZqkxcyS8yIam8BQSu:O8lYAV4TrtwZ3xc2Cmy7u
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bootkitraidcall rudiscoverycybergatepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2