Extracted

• • Target

    bfaeae681620317a159008c4de7a4ae5_JaffaCakes118

  • Size

    554KB

  • MD5

    bfaeae681620317a159008c4de7a4ae5

  • SHA1

    f9624cb69db2f0b451ff37c96b1623308a7689ba

  • SHA256

    a15aac0329d242dda150768b44e7264e8e6a3322019d5f6211959264600fe2ba

  • SHA512

    ccd57c8b266b760130bf62068e4fb849f64061c6cc375942290ddf82ba25ca83d422284e686d1d2b1706fad351e37197e9419c1df49d00cfb5569a1a2cd9438c

  • SSDEEP

    12288:OIqalbZm7ZpCHNbn9HQPbzwXDBdDuK3jaoztJjY6C39upN:bqYmdpsNbn9HQPb8XLzRgQN

  Score

  10^/10

  cybergateåáç æûáçdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2