Extracted

• • Target

    951fd196ad23578418fb1cccb1ded4eb_JaffaCakes118

  • Size

    436KB

  • MD5

    951fd196ad23578418fb1cccb1ded4eb

  • SHA1

    31891ed83d96932822204f63aa39e36b1357054b

  • SHA256

    25464665e75f6c7ec40dd8586b0dd9a718856d2e666ea387647f6285ff6d013c

  • SHA512

    ecbcc0b82a2d5716bbc5a4ada3d856b6937a9cbf263a37e109e782d0d6cf2f9f0196ac2eb80885a161d14ae47d46103d2aeb83acb4eada0cc9f5b060d2d4e255

  • SSDEEP

    12288:yN+DMPR+Mt2t0g/dSWL5rlWhmGW1Jv2frHEq14EbQ:yN+MtU0gdFchmF1JsDEq1V

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2