Extracted

• • Target

    d11a773caf6d102ae741cecb8dcf019d_JaffaCakes118

  • Size

    613KB

  • MD5

    d11a773caf6d102ae741cecb8dcf019d

  • SHA1

    3c45f9ddccf2f77ef5bcbc3d4371d89065e9bbca

  • SHA256

    0094c40743f3527a23090481f051e9577dd17d2245fda08d446de2dcab370cd7

  • SHA512

    b5ac536a198aea7d1639d3338f7a9fe36fb61e11e4b24d04e13e9bd0c9dd7747a5bae0cd247c478f31f2d2dd84d78b6a429f0de01ad2ca87cbaf9a84a4786228

  • SSDEEP

    12288:iubXxZ5Dr3aYV1fcyTB9bsiEc3XyX9u4VFqRsTSHuuC1QVOBFC:Nrj/fcyPbFD3itu4VTSOQVOBF

  Score

  10^/10

  cybergaterarardiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2