Extracted

• • Target

    43936a0b11da298f4a56957db56e5b06_JaffaCakes118

  • Size

    445KB

  • MD5

    43936a0b11da298f4a56957db56e5b06

  • SHA1

    704fb98d8acbe6a51b6f357e73a08248635332c6

  • SHA256

    06f929c0bc69e63f900f74558eac8839334fbad2d373247e71512ff2ca68bd46

  • SHA512

    c0478b17d651f8bbfc12300d8fdd4f7aa834a7da158627600361c585400e5e8ec85fa69b466492aa64341134ee82483aab1289ecbfe4ac3464264b0e0948f333

  • SSDEEP

    12288:aAUCn4kq8GNUN/s9cxVIjXBEHEA/PTP9c9b:aAUCn4kVTZYXBjA/rP9c

  Score

  10^/10

  cybergatevítimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2