Extracted

• • Target

    a3688c09a7bdbcd9121431e469c041ae_JaffaCakes118

  • Size

    331KB

  • MD5

    a3688c09a7bdbcd9121431e469c041ae

  • SHA1

    efc3fe27c623498331b80f5143063f09d45638db

  • SHA256

    559ded24add56cb5bd49fdd5dbf93a8b919cd6842eaf2b91b954153c15c5ee96

  • SHA512

    f0cf7bdd35d8eea0a530e1c468727f0523767c1ddfebf6fc89e5fc838ef040ec89eea2b0b8e18eb1703ebe851d77abf67aeb7e1cc7fe1b5c011cd44f0a65a53f

  • SSDEEP

    6144:PMPUmJNG812nyeMCMjrJpJ41WkpfcqBRu6p2KbwlMtK1g3d:PO5Nd2nyeMPFEWkOq/8KbxKCt

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2