Extracted

• • Target

    c1104e1897084aca6db4e0ff84ec2a8e_JaffaCakes118

  • Size

    337KB

  • MD5

    c1104e1897084aca6db4e0ff84ec2a8e

  • SHA1

    6e9892a4a83ad2bf76fdc58df772a6ed67c6f050

  • SHA256

    2acfd5a30ab557fd9f4ab12f52e48324544ad681e568bc98b8ff0e45ffa4e3c7

  • SHA512

    d88d3809c3634012ab904cef7c4b4c48d5942133cc4c8b74c368b7ff9af093e38ae7399ff9a5142c4475d1187ae281b7a508e84c293fa4ee9894a4cf8b5a8c16

  • SSDEEP

    6144:puS5brEdkhr1RPviaXxvE6+p8J898zs6J7oq6y72Wgu8MwUX7:ppgdyw6X89wJ7Rp8Mz

  Score

  10^/10

  cybergateopferdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2