Extracted

• • Target
    jaffacakes118_Call of Duty 2_0n7kgrl1.exe
  • Size 943KB
  • SHA256 a6e20f3b94b21e4c80bf94af5cc2012396bbab012c61fb2a7367f03ed094000e
  • MD5 cd1fec6e05f244661191a2f791cdd452
  • SHA1 fdcae49e059a8d18615700ff3ed9a9ec9d019c00
  • SHA512 7112980b7630e54ebcafca9c4ea95531df7573114dfade8fa6b2ad5f4174c81729f7566602a5a81d5e20ecdae70e1cfd87277581f4626b658de65a60c8698dde
  • SSDEEP 24576:g6S079Tapr6iHqVjmLe4ohsTurnV/PcA7I:pS079TapL8jge4o0urnVscI
  • TLSH
    T1C125220202D1962BE0E617719FFD62A36BB4FCE02B78A76F525D51A50C307C0A93976F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hf1discoverycybergatepersistenceprivilege_escalationstealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2