Extracted

• • Target

    4dd60dc8d5ec01479e2b39bfd91233a7_JaffaCakes118

  • Size

    323KB

  • MD5

    4dd60dc8d5ec01479e2b39bfd91233a7

  • SHA1

    2ee672b964cf18e7f7532c45159e7ed4114cbf9f

  • SHA256

    540b7afbc9848fde6a770905cb2da07a0dc40b41ae9fcbde75903637ed416b71

  • SHA512

    e8e24c834081b5ddd9c63a1dc2718128291ffb85ddac1ec36f7f1a9384f3e51570bd3ec9592a9247808ff126dbfe570358ba399f459d4565222d0452d52e2df2

  • SSDEEP

    6144:m5T2l2uV8r8IF3Nhc23rLD1cAA25JtURpwi03gI/qBisAqw:mDR02bLD1cl25JtUu/qBiNB

  Score

  10^/10

  cybergateserverpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2