Extracted

• • Target

    a0bcafb5a0114b3b354a46f1409466d1_JaffaCakes118

  • Size

    1.1MB

  • MD5

    a0bcafb5a0114b3b354a46f1409466d1

  • SHA1

    083ef6a2ecaffb8df511f17c9077e3ca87b1c18a

  • SHA256

    73216646ff38316277fedff287dca2a595b1ce7f954dd2ab6b5d599401f84cb8

  • SHA512

    dad437efc48d0103603bd8dd42958f8779c9a551e1d30d931e124f94b44ee06b74b343f0d1fe8510b411b0f1984fb4211b02427a38c944b00e529bc82d2f92d7

  • SSDEEP

    24576:EVLcWBPmEBiTT4hJs1FYjqoRYalhBWx+UHj:EpamJz1

  Score

  10^/10

  cybergatesheikdiscoveryevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2