Extracted

• • Target

    3004cf7cfee32b83ff606e7b7ca11d0e_JaffaCakes118

  • Size

    1.3MB

  • MD5

    3004cf7cfee32b83ff606e7b7ca11d0e

  • SHA1

    a75472b54dc618e85c40fe4c5e0f28bb01d45a37

  • SHA256

    53185bc14bd619f068ddc1204b6415a7198042b46f86c6a5653b6bf5cf03cf72

  • SHA512

    95d23a3f8235494c4b48e2c18cbbc4970500d121fe9c2b60998013e6cb2f2747157c15923abab61da739632f1720a1f4c0b293a3c50809fe43b989e3c54effcd

  • SSDEEP

    3072:9KHBafBWmEocn+GeHEgZvZL3VWF6KJL/R6wXQ1mYF/LhfKk/IwweoaKU7oMD9vZW:NRijOc6Ci

  Score

  10^/10

  cybergateöííépersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2