Extracted

• • Target
    jaffacakes118_Trojan.Win32.Bublik.elhu.f2ae615850b73c9425d90cf3742539e4
  • Size 384KB
  • SHA256 93030ba4f113591d09e27371b9dd59bca9b156e6d79476cb61a95fcfbd5a3af3
  • MD5 f2ae615850b73c9425d90cf3742539e4
  • SHA1 1a0e12a8105c4e41bb507bef14ed357865f73acf
  • SHA512 fb38bfc4e18f9a725dbaa4b23a1e4c802a44c09740ba74055685aa3d8e343b603f7f53787a2ecfbc4ca339a871cfe2ffc833f66266ee4f82ad6faec46dc3f6ac
  • SSDEEP 6144:eJ+jD3okpPFv9hu8OLgqUopVbZDXOM7Nu4bYj7nozBKPPdIv2qjKV/jinRE12I4M:vPHho1ptFBQ4bIoz+PA2qj4jCCPjRsHQ
  • TLSH
    T13F84F138E9E2AC4DD40B883D58D506003E64A9C38877DE54EA97B597E448AF0EEFC771
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  admindiscoveryexecutioncybergatepersistencestealertrojanupxdefense_evasion

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2