Extracted

• • Target

    WKey.exe

  • Size

    47KB

  • MD5

    cd31f6accadcca58e7ddec7801f35e38

  • SHA1

    a5ac1796027914c67f4b4686011635c8e6b66d1a

  • SHA256

    b3327ed93a5a21f3d287840a9cc9b11cbe47d04fab590cd081e6ab11d823aab3

  • SHA512

    d72e578be4f5a7212f19e90ab1e8e74a60b155a2fd6c65867c43e6c3d96edb20d45b7c7b602291ae89939c22bc695ef73deeba8e17dc99c0b582865e877e301a

  • SSDEEP

    768:AmCx9CVmkfcsFVnC85LgdjxBjEk96FZMgelXPlR/PM5KLXUHRn1:pCO7qjxvYF+gexPX/0RRn1

  Score

  3^/10

  discovery
  behavioral1behavioral2

• • Target

    ppi.exe

  • Size

    636KB

  • MD5

    1cb8ddeed4d6770555219d20261e8807

  • SHA1

    bb9b222bb3e8ee7103ef93155f3bbc3fc12f5dd6

  • SHA256

    3200c1decf9622ef23c4c8e52f9e5d6c48432ce54d86f04202c146d0ef1874f1

  • SHA512

    7cb1f2f610115517517ff1bd03999d33c5d9767edffd7786bfce6f530fcc2d5b62b7cd1a11e9dcc2cd612c265f7b0a7891831cb505ee0818515a113ab029c49e

  • SSDEEP

    12288:vKqHD2AcIQMondvw8bt+DQ8v9pctE9ekPFa2yIPor8P4UXig573cVJNcqzUebZ:5DpwSigaNHbZ

  Score

  10^/10

  cybergate2010bitch discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4