Extracted

• • Target

    zynga poker chips 2012.exe

  • Size

    671KB

  • MD5

    a9d778ba1dc4d7222a875c14b14a941a

  • SHA1

    0eeb7cc8d724da53cc3396f142d8fbfc685b029f

  • SHA256

    afb93b964f7ee12ec0bfadffda16eb7ff3ec6488b6975e1d6315031eef339b9d

  • SHA512

    e13336826ba0f00e3a4cd4b1e6a0ef37e94ed26047e0abc289240e2767cf7958d3aca98f0ef4e67c969da700909df8842e4614645c609f43d17d3e00734a4a21

  • SSDEEP

    12288:b1dlZo5yUfltbzi4uC7yPD6GOo/K2ZxcqkX1B6c7C5GwCgvFJ8+KTH9B:b1dlZo5XgC7Y+6LcqkXqlGwLvFJITH9B

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2