Extracted

• • Target

    a563b1f2b39d5c4a200ca30719297aef_JaffaCakes118

  • Size

    906KB

  • MD5

    a563b1f2b39d5c4a200ca30719297aef

  • SHA1

    f5b35922a91325cf6715b549e9ba0d845efc25d4

  • SHA256

    f4a02b5f7fca2a29a13fd089ac5ed9f435016288e26d26024463b711747b6ca7

  • SHA512

    36e8becba1e231b125c86081e106922011bd58013be28a232706d609ad117627251f559b26d4348e9b29e3e1e552a0f0c2509950626829bea2574f8e357c39c6

  • SSDEEP

    12288:o6Wq4aaE6KwyF5L0Y2D1PqLDKPDF5x6+qr+aiTb5wE+6loe5TN1J0rRbD:+thEVaPqLDKPDF5wr+dhwv6lx5QRbD

  Score

  10^/10

  cybergatevitimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2