Extracted

• • Target

    9febd4b7ffcb8d25ba9611af1b0fe988_JaffaCakes118

  • Size

    344KB

  • MD5

    9febd4b7ffcb8d25ba9611af1b0fe988

  • SHA1

    6a6cbb874c0698187537d16409e710235b368340

  • SHA256

    6deb6a3ec56d70a82c8c8a18e1e95c02584e4c01fc976d763ed256b867bc3bab

  • SHA512

    087463f3f2809a1840ce456565c79eeaaa2b70fe9d1db8b8952eae83fdba051fa9ded6930987d7c53ddc49310305ed9ae713ccce0e99e435b894889e466ca13d

  • SSDEEP

    6144:IqwP6jCGqdlRRPXJI80D9AvT49rLw23NL46n6KoJJ/DGSbf6ZHDXXzU6v:IPkCGqfNK9A2Lw2F9Mlj6ZjXXoc

  Score

  10^/10

  cybergatesbynetdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2