Extracted

• • Target

    3a9787f043e90d693a2a431ee076774c_JaffaCakes118

  • Size

    811KB

  • MD5

    3a9787f043e90d693a2a431ee076774c

  • SHA1

    078c7d9796fab021f5f60cc049a8fdb0abd9005a

  • SHA256

    c09d4d7895581b760abd6b281588fca0558e237140e33145346e1c52c250cfda

  • SHA512

    d19120a7652148ccb592c489b96c01f2b074ccf89bb71c9951d90bd0d3ba93b320d92275381d88964ddfc80283271299d90e814e060ef2171ac082b2cc3928ab

  • SSDEEP

    12288:t6QoV+P/OBEhE2EaCbfVl4rBp+2tLxBVokprbFH19dtEfS0D4DR+8K:troVEgVlU+a7FH19jEfS0MDR+8K

  Score

  10^/10

  cybergatecyberpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2