Extracted

• • Target

    d5384e93b6a7927d50d531bc4c5131b9_JaffaCakes118

  • Size

    398KB

  • MD5

    d5384e93b6a7927d50d531bc4c5131b9

  • SHA1

    c0c7683b24e767eaea8face46b8d15b26697b8e7

  • SHA256

    63a690b36b9a3c40bbbb2357bbc3fb6a10d61c5ce0a1b7eb6b2c70ff6f29a6bf

  • SHA512

    985003f2c4678985ca7ccd0060d82e8ac0ce013bd783ef042328b496d2b69d85d52b064fc1599634b3ccd2e4ad04bd5471fab6043885c81420f452fa1de8d0d6

  • SSDEEP

    6144:MsiQHEbHUVP5oOUsnj0b9xUrH3wexIDdbx7eWTuL8aJHQZmaiFcptzKI3Dd:M3UVnj0b0rXwexGdTA8a6ZSFQtz

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2