Extracted

• • Target

    fc5ea46a4629e78618a3de93299ca834_JaffaCakes118

  • Size

    311KB

  • MD5

    fc5ea46a4629e78618a3de93299ca834

  • SHA1

    5dcf5f51db88bc3feffc49915a179a66dfe718e6

  • SHA256

    5954000f4aa5980772ae58bad68ddc7dc2896c6852aadc30e358bd35f2d5bb8f

  • SHA512

    457a77b61b6deb20d3aebf3d1a20984c8106db2eaca388cb9ee7a60b097906180cd2a273eed14c8ac67225a5e9be1a1a5315ee58fa0e226a4f3913230a47ac27

  • SSDEEP

    6144:BO+VbK8KuVJQgTMlV7SE3HJMuuhEKaQEcAYMHz:BO+RhZVIlV7bPsYT

  Score

  10^/10

  cybergateyyyypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2