Extracted

• • Target

    0114089c1de32d68c7677870e97a0732_JaffaCakes118

  • Size

    532KB

  • MD5

    0114089c1de32d68c7677870e97a0732

  • SHA1

    4e26532bdbff6c3ff0754e1732a751a737ad9513

  • SHA256

    1b835003c79f7b6500949b6a0a0d17a8e9b7688155399165593c00f09661940f

  • SHA512

    2d3b050bc4ee3eb4721ecbf9bc56c119c6ebf35c12e59a692346ecf74385c2a5793507aa4030db113d014d2764c5dfc36c66d708f7225d1d810f7d212fc1f0bf

  • SSDEEP

    12288:+GeJ9QOB7F2hY7n1JDiEhAGYejtEtt8cQ7xQMat3Ce8We5GZr:Fe5B7F2hy1chjeEtG9xQ9do75C

  Score

  10^/10

  cybergatemedia.dllpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2