Extracted

• • Target

    08b4bef7fdbf81e383bde20927ab9cb7_JaffaCakes118

  • Size

    4.0MB

  • MD5

    08b4bef7fdbf81e383bde20927ab9cb7

  • SHA1

    245a3a1c0231f90db6f8fe29163b3708d29d312b

  • SHA256

    ed42cdd9dd2a2547d34f280fac240397bde7e818f1705bfd69c2410d991fc343

  • SHA512

    5605b259e9791793c60e9b2c48af637502e3a0f77a1fb1ba8bf3e0aaa20b6c2ee9cc6716fb0171366d4e88b6befafa1dc2eb94e099d4b400abfa6a7d368b853a

  • SSDEEP

    49152:jglSlx/EXnSxiMxu1U5a99mrL6D+1Z09fB9JyvjBTm/DUnjFJ8ee6LV:

  Score

  10^/10

  cybergatecustomerpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2