Extracted

• • Target

    659248ce99d4d03e8446c09e8cf850a5_JaffaCakes118

  • Size

    483KB

  • MD5

    659248ce99d4d03e8446c09e8cf850a5

  • SHA1

    4e877d60f86e17b49fd38e97b02d16f27faaebc5

  • SHA256

    7d447e865a95d4ecc577b03e425fa5ce0d870db8c63d8e64d882ff751185a84f

  • SHA512

    b5c94b704925bccc1b5952fc810ec346937da65845a6b24e4c2cf58c91df07d28854e0fac7a5fece4409990ade242b9d071d1b1df12bbd6bcd776e9bc597049d

  • SSDEEP

    6144:CHEa0SUlqWNbOiBZ2843k9Vz+ujhNaD7CsYjMaK4wsOvASD5z030uy3eNG1OnG1d:Cka0SRWRk88ojUC5MswbASQUeNdG1K5

  Score

  10^/10

  cybergateæõápersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2