Extracted

• • Target
    jaffacakes118_Trojan.Win32.VBKrypt.slfv.d3be2feb2ebc8ad3580fdaa30d389b93
  • Size 346KB
  • SHA256 6c48f8694010d2cee97927e5d57812d35383cffd0a053399571418c2c4d62d15
  • MD5 d3be2feb2ebc8ad3580fdaa30d389b93
  • SHA1 7976d75f083cef80bc7dc7cf09c729e7ca65668e
  • SHA512 03d37b227c12c8ce343bfd2845c9440fb1eccf9b146065c3ba2246499f88e8852de813a8fb141e2876994d191d4d2db4d25dc7dfae3ea785a09811a5874bd4bb
  • SSDEEP 6144:9XtKt+VetfrtsL73Yh2EwjwIoAfsLaLlm0MRFpVIHptXqMY56hjgo14:9X0Cs+ELuwHAUWLlQzgLqMWOgG4
  • TLSH
    T1FA7423AE91FD6FE4DD9172BB184239D283346D3DFAE743CC3924A218F85ADB06461D84
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  out keydiscoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2