Extracted

• • Target
    jaffacakes118_Eminem Feat. Rihanna - Love The Way You Lie.mp3 works.exe
  • Size 3.0MB
  • SHA256 f9e9fcd70b28522835259bf25738afb6bbc01f24d61b68af5e302c9772684de5
  • MD5 294691f1ad76cbdb61fc343d2c2d380d
  • SHA1 dbf87c44add616989ab2cbac05025dd249d2aee4
  • SHA512 47665073706977d77c4ed12c9ac3aaaf1eb16e4c17689682ab68c515e7d010a6f853cc7387783a08d515ccb76c7a49d69d0762facffe4ba9c84c09efe95c8fc9
  • SSDEEP 12288:V43hOzB0uL6mT05jvdWVYLACW+y8tWxREgeq2BgrfI+6V3Ss+:23c305jvAVjvxREgeFBgrw+w
  • TLSH
    T151E52FA3F1A0D10AD11EC73FCDCF66A361AD665C4167117DFA50A32A92E63B3B9EC104
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  vicdiscoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2