Extracted

• • Target

    Creative EAX Settings.exe

  • Size

    3.4MB

  • MD5

    95413932fc696781ccbbc5fb34d6d244

  • SHA1

    72cd83ff778160751a9b3ea51e9ba527111d4ec6

  • SHA256

    3b6930108f3a36822c7e27e8ce7848cbedd3b37c0e21500ab45a5b9956d687d8

  • SHA512

    6b32d8e69b36849d5d61e70a9682fce2017105009349092f964496934c652201a98b960891c5b92bee7558d863a9e161abea9372edaaac1e62199ea44b1752b5

  • SSDEEP

    49152:uEP+CRKbnhbwXcdzs6LyDCxzyDKM7DPUD12VP:uMQb59sUzOKPs

  Score

  10^/10

  cybergateviros.alasiridiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1