Extracted

• • Target
    jaffacakes118_43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1.bin
  • Size 457KB
  • SHA256 43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1
  • MD5 ffd94e1a99583a739a17924fbee8d9cc
  • SHA1 40d0f1a3ef994607e60fd46be59ee8e08ac367c1
  • SHA512 7b108e72abe88f3c3f99c2048a683bf2b03b284294ef63736ffd9996ed403542a0c342bd35f8de86cf05f6bbdd341ad187bd013a1aad417bb9da76532b9aab57
  • SSDEEP 6144:LmcD66R78LRvee4LRveeNTYZ35JGmrpQsK3RD2u270jupCJsCxC:ScD66k3O3NTYZGZ2zkPaCx
  • TLSH
    T159A47C73CE00FC32DDAE887CEC5782D4BAD71EC1B16D57839B907A25C49A662C74825B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  vítimadiscoverycybergatepersistencestealertrojanupxdefense_evasion

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2