Extracted

• • Target

    489ef93f8d7641bcee747d2594f09f10_JaffaCakes118

  • Size

    566KB

  • MD5

    489ef93f8d7641bcee747d2594f09f10

  • SHA1

    a5cb6dbd26289a14244cfad0f1ba647b35c62cce

  • SHA256

    54feb99fc0ce50cb39203f60c6411014496ce329739675362900725679326a9a

  • SHA512

    a9ec3c5cf41fe6710321e048ea860122b35c43039e00939479be8d81de36a6b437270d16fab1fb81dd526b3d02a7ce8e097a43e82698aa0f1b388be0994a774b

  • SSDEEP

    12288:MjkArEN249AyE/rbaMct4bO2/VTZhLdT186tstM91fc/qSGNpIkvSP6:/FE//Tct4bOstZhLdhpstUZtSupkP6

  Score

  10^/10

  cybergateibrahimpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2