Extracted

• • Target

    d655b0555fab1cf167511baa88cf447a_JaffaCakes118

  • Size

    923KB

  • MD5

    d655b0555fab1cf167511baa88cf447a

  • SHA1

    34cbca8ced2451d34c357634150138fe0492ee87

  • SHA256

    eb678706926fef36fe5b5cf83495f25277f4121095f712ea825d09ba935df339

  • SHA512

    934cc18107242320c071cd7b17addd5cb0cdfd755c7b54b5603d8a437b4347fe18018cc8c1d27ec1a81ed2a56b9a2536b04a42bcb3e225fab14bce79eab3d152

  • SSDEEP

    12288:Aslo7YNQzLPxez8dFlZqBz92ZJ0S36egM7GZjRydmKceG8kaXFSm5stIfZdsGDob:AwQAz+8160S36egiMymL8LXk8ZdhS8FK

  Score

  10^/10

  cybergatekurbandiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2