Extracted

• • Target

    dc5adbc4c94e76c006a67202cb88f4ea_JaffaCakes118

  • Size

    1.1MB

  • MD5

    dc5adbc4c94e76c006a67202cb88f4ea

  • SHA1

    ac7c67f15c77953169d2137e73da869af34ef8dd

  • SHA256

    272b3b6ccb49a16e12f5dd8333cd54dcd2ddb044bd5ad67edb888a5d563a6b2f

  • SHA512

    8f0990af5c18dcfceec7052e4b90ccbe5b831fca4ba07bac72ed80fbb79b57dd63393dc520f708142ec7055f20484210158605abb391e26af5c6e7f20b8258d4

  • SSDEEP

    12288:coj1iVAUm/bYL9gIs8BkNmZ4gZKW7NGFVTKAWzk6mC0DZvyURygKN3g99:XMV5mU5HHBaBgZRGjLWzku0DY88gn

  Score

  10^/10

  cybergatevictimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2