Extracted

• • Target
    jaffacakes118__28c71a02a505c74d98c8a0c276d3f9e7
  • Size 850KB
  • SHA256 7188cf21ff1b257544fe554aa1f9207a1712f95f13660a48475b0af4f9adcd45
  • MD5 28c71a02a505c74d98c8a0c276d3f9e7
  • SHA1 1cb00bff2f0ce310d4c0d45c62c57f38898fc07e
  • SHA512 1d46825d5924c79da4a979daeec0577adfff036e7cd89c1efbb78148dd3f9d9a0f40be3cf70895245b5e3734eda70c22fd59615a0ba630bca2805692a467e03c
  • SSDEEP 24576:U0wwuFQZfpcYRzQjbJfVhcIIVclgfw1NHZXmC:pwwiOBwb9VhyVvWxZx
  • TLSH
    T12805230A536E4D05D4616E3AC263804D1374A9EB2D05813F254FFCFA7CB90DE5FA7A8A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  supaguddiscoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2