Extracted

• • Target

    8bd7f4a72de572b143432ab3d26b179e_JaffaCakes118

  • Size

    1022KB

  • MD5

    8bd7f4a72de572b143432ab3d26b179e

  • SHA1

    d2a8e3afa0e43caccaf5418e3324657c9febef96

  • SHA256

    b7f2078adcd191d0057ba1fc19cf7bfde764d88e4c6498c40f528384a0f21f5c

  • SHA512

    838992db66e3fc0e792a37a2d29408596736a98617028dab17f6ae72803afd6a58376336f1496c7f623b728236e00720fe234cf76017c81d844c2f15d596f44e

  • SSDEEP

    12288:SaWzgMg7v3qnCiMErQohh0F4CCJ8lny/QsmARldauNs+CduTx5Rjexzvd/aH5x9I:daHMv6Corjqny/QsmSvv6+CdwxLe1Y58

  Score

  10^/10

  cybergateddtankdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2