Extracted

• • Target

    dd2af62a6e7a3bd61349cc1be5e12331_JaffaCakes118

  • Size

    911KB

  • MD5

    dd2af62a6e7a3bd61349cc1be5e12331

  • SHA1

    c396c842391a41f0d54ddcf1261bd6f1da5a8236

  • SHA256

    7c699fd511523a95ff7ec387fc198def39247db23a9a90892dec6c27e45cae38

  • SHA512

    e39f12223f4ebd3b67a78405e2147d99531ace6f29e08c30f620a2978d20a18583a50eb0a8fd2cf814f230ae74b4b6011e85f46e7e1bcc56a4de61f2c81dbe9d

  • SSDEEP

    24576:W/h4nro08r12+we645mNrWdFnBB6hdN+H/ItLKLX96k:WJ4rox4zZNrWdFnb6hdN+fAKLt6

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2