Extracted

• • Target

    bad155f76b972b1c8d34c7bd82059d46_JaffaCakes118

  • Size

    298KB

  • MD5

    bad155f76b972b1c8d34c7bd82059d46

  • SHA1

    f7ce042336acda0e8d193ec3cba34d24c98523e5

  • SHA256

    8b02cb344975a928f19e902130f0d1c9fb47288725b8c01c9b7630d0506b0a91

  • SHA512

    7826812aec9f6a51ab09abdd87843cb7a300b4bb35fafb1de5724e8a5559e4de63fccbac84bb91ceca1c6e4ab9f27a925f29c122717b35304b6bccb2c0d5bcd4

  • SSDEEP

    6144:WXvr76lJlVTOaNDANdz5MmFOAzl9w3xRT7x58xGgpYaHKVpji+klBDonywb:UvizHOai5DFOAzl9SFt5+GSnHKV5i9/E

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2