Extracted

• • Target

    bf233cdccdc84403bdc1074b735268e5_JaffaCakes118

  • Size

    876KB

  • MD5

    bf233cdccdc84403bdc1074b735268e5

  • SHA1

    97ad4b6acafa2b885b7a262848ef094f8a20562b

  • SHA256

    c3ecbbce7513499c92f3d5ee20d3255841d3c4851825acdb630c263360d947ae

  • SHA512

    8df34a45d5c0598e76bc76114a50235f69c9350ecd76e7b2d75b6f8b87b3332dc9d0bd5e660a67f8fc82eddd404c54c8662e66614b6651a3b03e5c8b4e8f55fc

  • SSDEEP

    24576:GfhvOohZS0vc26bnbs4386pjl7suh+fjTC8FUGeZg0o:+22S00Nzbs4MSJ7sYGJUGCFo

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2