Extracted

• • Target

    84e032c7122426dc4ad5c7f6f1ecb398_JaffaCakes118

  • Size

    885KB

  • MD5

    84e032c7122426dc4ad5c7f6f1ecb398

  • SHA1

    06639d87e4beb5a98ceac673ef1257a5f539eb73

  • SHA256

    6a16c5e09e531c09cd513413f02b4ae353757b48eeb81934e4965b0190b03911

  • SHA512

    1e347fe2543d26cd601b62fd15d16923a67bc1436fc87c9776aaa3b08f1a7a36ec74b23e80a50b701767c1905126c988f91bd9ca79df5c25187e9d2f31bb84e6

  • SSDEEP

    12288:ZXg1m/8Cuyu6SNPP/f9rbd84NQysOZtK+hN9tp2QJ14OzhYRe688YZN76a9BU+qs:aRyspQOXl6+GxyvD

  Score

  10^/10

  cybergatewsb52000discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2