Extracted

• • Target

    2b2ca930c385001995df40dc65208f96_JaffaCakes118

  • Size

    682KB

  • MD5

    2b2ca930c385001995df40dc65208f96

  • SHA1

    778077facfebb99d764698ce2ca2513609c5f9e4

  • SHA256

    464af71f454798a05ece22cd1c1110b2bd9012c0c9642567e4a36dd75c1e185b

  • SHA512

    344950d640d552c57ba05cca1aa7afea1377b7997f97e5d5dd8f2f2f427f05d7facc7dd75c5ea76896de9b1ebc5183cd9d4d1b3897d70f4ca60bec92344321fc

  • SSDEEP

    12288:eeoy6toS493ACIl7vI1kiqHNnyVek/a4QmHNX467pixNcj/2ylxlzBDF8itex2pP:eeoZoIjIbgyLC495467MDtyvlzBDeitx

  Score

  10^/10

  cybergatevítimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2