Extracted

• • Target

    30e130077648276e94a8a1bc8d79f753_JaffaCakes118

  • Size

    334KB

  • MD5

    30e130077648276e94a8a1bc8d79f753

  • SHA1

    3f54f8b2ce5aa0af339e67475c01840e987b98a4

  • SHA256

    9ec915c71ed36b9abd66179ebd68cc559703a402a9f090117dac4b9cf29e5d00

  • SHA512

    b8978996a869850377b031b78bd925e9a5be63474ac4716a680b632ca1777a4707551b222928f30adf8c25e7cc154ab5b7cc75cd03f5ae2e56d93a5d20b486c0

  • SSDEEP

    6144:RvGclgaSlcXPH6U8RwUktKc7X/zJH+1R69UWRvjRmQolvVIoVObkOA6:Mc+a2cXPH6U8RhsZHsRiXnolt8bkOA6

  Score

  10^/10

  cybergateöííépersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2