Extracted

• • Target

    e7149ea3cbcc7554950761d297dd5a50118b26200a2e07e438cec7ca0d3f8bdf

  • Size

    346KB

  • MD5

    7bd0b3e079ce011bc534053e0c3d578b

  • SHA1

    b4e9351513e86a969b2ca74f240507a2dbdfb0d3

  • SHA256

    e7149ea3cbcc7554950761d297dd5a50118b26200a2e07e438cec7ca0d3f8bdf

  • SHA512

    e635835267f7fa873249550094e91885845392479d6fc461bfc700fd9de1a8811d6704bb38d3b004c7aee89aaeee78d0c2936435c4205a6d5315c75cc00ced0a

  • SSDEEP

    6144:+6jDda8rBLk4LdxeZajxttldTud+sZpuBFs5oVr99jjJrKZqP0Za:HjDda8rB4qx3jx37ad7buBFk8bfZKZM

  Score

  10^/10

  cybergate(( = habbo v0.8 = ))persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2