Extracted

• • Target
    jaffacakes118_Vlc Media Player.exe
  • Size 5.0MB
  • SHA256 8b54f643601dce13a9bdd18af808da95a61898e7618d329e888bc94ae6c956df
  • MD5 7fad075e1325bc6aa5cdab41d5e838b2
  • SHA1 90bc19401577007dc8c9bf4c93b10c89f533f373
  • SHA512 0a6a1fb7ccab1c83581b951b21a15a9e72aaec556a40979f4a25559b4f13530a538f118c6aaf482fcf8b70f210f005057139e179eb80732b6109a1cdc4f04665
  • SSDEEP 24576:bhjcfXtRGXiPVa5N0BfFuOZC8xNYrx+qvDstO4FNzMMMMMM:b1OtRHk8BNuOZC8zYrx+qvM1rMMMMMM
  • TLSH
    T1B3366687E11BB406F79C99BF488F46A132BDD48D7927808DB94CB774A3DB48E5EDA004
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotediscoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2