Extracted

• • Target

    2f04314cfb90cfac1f436965f3d603a6_JaffaCakes118

  • Size

    2.8MB

  • MD5

    2f04314cfb90cfac1f436965f3d603a6

  • SHA1

    735ea2c1956809a13e3fe7c493539b6b558bf2e6

  • SHA256

    26eab38ea7f9b5a6d1fde541c3b3d461e7b48709d6b4fc4205efe21bdc5a4250

  • SHA512

    d8b6833c8dfb2c6f84bb7c1af4fd8bdf96f455ae0bf02a4b9b679ae745a71b0db78dc3681e741efa9b0f405ee68a31e1f1b88184ea86f236e6a2101ce17c0166

  • SSDEEP

    49152:LEIkri5XR61N6wrKR3MHolnyx3uGYgLNfLZyYRI:

  Score

  10^/10

  cybergateêóäðßâûépersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2