Extracted

• • Target

    2eede5ae3f29247c4e2dd5cae7647fb0_JaffaCakes118

  • Size

    1.7MB

  • MD5

    2eede5ae3f29247c4e2dd5cae7647fb0

  • SHA1

    682b8ffaddcb8099563a4cc3ab00248dd5eee0e0

  • SHA256

    d842d0b11b24ba0d0ed6e650b3b87ebf8d5328abe07b025bb4ed9c542b4ad414

  • SHA512

    41ee2456c0408eb281785fc0b78c2d4384d75fe73a7409c4d04e2a59db2ce728269c4d22ed41eabdcbe728f45ecd6ddc0a59b0813512c08dc0e70b60822b3268

  • SSDEEP

    49152:vGfu2mloFTC7ixTHTCYij1bAb0HmMvmN9RrfIkyhb:KFTC7keYijli0ElNyh

  Score

  10^/10

  cybergatepassword decrypterpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2