Extracted

• • Target
    jaffacakes118_BitDefender Internet Security 2011 14.0.24.337.exe
  • Size 4.0MB
  • SHA256 0a27be38bfc7bf190445996f6f5a2ba1bd8a7e77271c7b620d39c38938ff7d32
  • MD5 cb7e066a37a7332deda2a2e1d9d0060e
  • SHA1 c866dc0e7807fa7097bb96d584a86725402004ac
  • SHA512 ed8873bf1864394960f80d2eb47af231d42d951cf747b7ac638489fc1d85f7ba4d46ca70c5cf803819ec68123b93fd15e8f893903b2cbe7c3830a2cd1235f540
  • SSDEEP 6144:nns+XBHnJoMr81MvTqythAWKxIQegHgndqL8f24AR0DDw9s9huwTkC27chE7WAa:1F91TSWTiHgdqP4AR0Dk9a5wC2/d
  • TLSH
    T1C916FE87B50CD58ADB59A33DDC8F7EA023EE914C0203516BB8807F68B2E61575DAEC5C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  10_02discoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2