Extracted

• • Target

    4b72ef17c2373e09b9db0d7e05fc57ff_JaffaCakes118

  • Size

    364KB

  • MD5

    4b72ef17c2373e09b9db0d7e05fc57ff

  • SHA1

    d642dea9a0d6451fd3f2e50c888715caa532560b

  • SHA256

    0616f43248573a9ece52822856cc0f5e00944c812d52ab7a358c02e88e98acbb

  • SHA512

    d5b7473506463b6340ebc6d85099585aabd9fcc4a88f6ca3e93c6ae4be5912bf866f97fe6f03a6c05a7cf8149ec5940960a0a27f189380b2493c219bae3d0c50

  • SSDEEP

    6144:m49muNl1esKOp9OXc0Niw7AcD/8vSisHTtt0g9LL9bvzfM8wSNYbxYQWH89O1KTJ:m+muNzpsM0WakvSi6TtWgdO8zaxAH8Q1

  Score

  10^/10

  cybergatezrtpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2