Extracted

• • Target
    patch.exe
  • Size 615KB
  • SHA256 8b37195dfba32a05f15cb3f5b1d202bcf520b01ea5cfa4dfee4031e6dae5acb0
  • MD5 e4f73f12a8b12ec9a2c97a3d669088e9
  • SHA1 4ad386d4fe5ec75e7500b9f37ee1d32763c4d1ba
  • SHA512 a4b09a2d2d97ee1a872dc5f0b3791c7e37abfa16338ba23de8d3c066320da91415753f2568fe9b753c1485bffa625ca08fc8d1a4dac96eaf16aa71aaa82228c8
  • SSDEEP 12288:qDDayNP2zaR8A5+nzSN26WHHnchTEN8g1FWm5DvZyf0LS:caC22+zSQxHHyTEt300L
  • TLSH
    T1A9D4E132612F8CF9EE0CA3FFB95E7A5C1F350893D871A2B5A25CCFC2629134256B5119
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  lightdiscoverycrime24_stealercybergatepersistencespywarestealertrojanupx

  • Detects Crime24 Stealer

  • Family: Crime24

    Crime24 is a Windows stealer written in C#.

    stealercrime24_stealer

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2