Extracted

• • Target

    891be39d8da44d0bf0b52c7d9792a130_JaffaCakes118

  • Size

    290KB

  • MD5

    891be39d8da44d0bf0b52c7d9792a130

  • SHA1

    95da8d9a4d1667c76f2a99947e82698e2027c040

  • SHA256

    25509687297cb2495044d6a82b8cb9cfdcb0e0d36c422c9a7a2faac308d6aceb

  • SHA512

    c1dde25f294c5a2ecb87b03bda137ce2d2b6a052455934ab54d76736b2058f810261e96206dfbe66df1a13eeb1a29220ddc809e246d1c7f73e3ed3d390ee59fe

  • SSDEEP

    6144:79B8EuZQundkRcDJqVsFcWTMC1IXOm8k9b2JW9A68RhbfsG5OVpfsqTB:79B8EuGgwgt21CIXOm8pJW9Z87jsxpfn

  Score

  10^/10

  cybergateöííéaspackv2discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  behavioral1behavioral2