Extracted

• • Target

    ac22834391f01037eb842c8015dce658_JaffaCakes118

  • Size

    555KB

  • MD5

    ac22834391f01037eb842c8015dce658

  • SHA1

    eb754733aa56c361379029db19e531a7f0749428

  • SHA256

    698316fbde1ddf18e115da00a1bad3539410a804d6909d01f140bc9428decd7a

  • SHA512

    db6b6f880a616acfd0726761edcd0c804336f03f7b414ee94b1dcada1d0b85a0774765fb4f55090f81f8a05dccfa6cd60c1c8627f5f31222f4d9168220f1d762

  • SSDEEP

    12288:BBMmKGnhDT+JlCkuRRUX8HHeGVxTUzG8Sge2S8:3MmnDC+hl+f68Sv23

  Score

  10^/10

  cybergatearesdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2