Extracted

• • Target

    415686429e030af5a765abcdd945041f_JaffaCakes118

  • Size

    639KB

  • MD5

    415686429e030af5a765abcdd945041f

  • SHA1

    d771e68969526865b9096eec853d1918cb6e9947

  • SHA256

    dcc0666b0a379c68308b5050b3a6e3c687705642a3fcf71e34ca5c3f67cd7ade

  • SHA512

    437755a062fc78a14eae83937cd11273f922e1127a1ec9ca415858ee009c6bb10d396f446a6e73520b432a06d33cc13ab4800ea6305468b18a67e0d725860b62

  • SSDEEP

    12288:5fm85qFDc06aC/9R+zLhR87+iK/lGRgOUqmq9kR6lhKXW3z0Xb9DLk/1ik:hm8Q5C1R+zdW7+iK/cRgOnmq9g60NLkD

  Score

  10^/10

  cybergateserverpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2