Extracted

• • Target

    a158cd6371e2a65c1d39634b5e5c924b_JaffaCakes118

  • Size

    2.8MB

  • MD5

    a158cd6371e2a65c1d39634b5e5c924b

  • SHA1

    bb5fc78494bbcfcc24a148dfa56c095cb2202434

  • SHA256

    b02106c89d35212945ca41d5af67f2565c14ab2e880e53096725b75d039e7d67

  • SHA512

    5a9cd2ef2fe4adc0a2339c234dbec3c72598d41a391360c27e95a0f6a9fa20f990a3a521e67736dc7df745556dab31d6b1e944cd8a73308a8c1eaf8848a7f1f6

  • SSDEEP

    12288:05kMDwsoOSii+LVBiXnqWxBygZiMC8C3IJke2XN/DHcho:rsOii+JbW3ygsskPpD

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2