Extracted

• • Target

    0edea53967a8fc45014ee32fb14d63b9_JaffaCakes118

  • Size

    339KB

  • MD5

    0edea53967a8fc45014ee32fb14d63b9

  • SHA1

    1a5c3df089f0e9f5c89f12d03d05d6fb0af69700

  • SHA256

    a76f8f03c1fcb432fa98ef520331208878bf37d3fc3696c1a785f560c98723ad

  • SHA512

    3f2eacdb8c735111fa3aede7065d8ff83114e6dd0334c03b91cf78fa1841c770f0e33720ee286fe4216b2718750da61fdb4dc9ef1cdc0fec76f718fe49c84c4b

  • SSDEEP

    6144:PwjNKjjNAvjNTj7mn2aOAP/fAgFh7nDcf48eKWNR/iUdLM1kEioy3woThBEy+Voz:PwojivN3mn2MvAINC48eKWTioLM1kL1z

  Score

  10^/10

  cybergatevictimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2