Extracted

• • Target

    d467d354d9de3253b8c9103fc2187cbc_JaffaCakes118

  • Size

    325KB

  • MD5

    d467d354d9de3253b8c9103fc2187cbc

  • SHA1

    a45c3fa18028157cddcdd88288ec9a7eaa721c49

  • SHA256

    a661b06feb97bbd02bf26a03a2f24fbd9a004b01c3340f724775fd75cd438271

  • SHA512

    b4e9e9ac41c56e5479a47047400d10251649b1cdb75fd277fbda925899fc0ba517a3bea90fab1cc88a13427c8070006fde8d9f3f16f955473e4c90edf046cadf

  • SSDEEP

    6144:D6w5JLZIPgBjB/xhcx9OpINuKiLvoTa/XQaPdunK9p7dCuxlquy:fhRBA7oINuKXIQaPoK9poqy

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2