Extracted

• • Target
    Creative EAX Settings.exe
  • Size 3.4MB
  • SHA256 3b6930108f3a36822c7e27e8ce7848cbedd3b37c0e21500ab45a5b9956d687d8
  • MD5 95413932fc696781ccbbc5fb34d6d244
  • SHA1 72cd83ff778160751a9b3ea51e9ba527111d4ec6
  • SHA512 6b32d8e69b36849d5d61e70a9682fce2017105009349092f964496934c652201a98b960891c5b92bee7558d863a9e161abea9372edaaac1e62199ea44b1752b5
  • SSDEEP 49152:uEP+CRKbnhbwXcdzs6LyDCxzyDKM7DPUD12VP:uMQb59sUzOKPs
  • TLSH
    T1EBF57C26BE8D8437D0772A3C8D5B639898297E103D38495F7BE45D4CDF3A781792828B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  viros.alasiridiscoverycybergatepersistencestealertrojanupxadwarespyware

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2