Extracted

• • Target

    de0f9d43b24498c7129d26f1e7ec7153_JaffaCakes118

  • Size

    648KB

  • MD5

    de0f9d43b24498c7129d26f1e7ec7153

  • SHA1

    9860b770f0bdf13cfa01ce1af00682e1b8782ba3

  • SHA256

    dfede253c562475b8581d52a2f0954b0a0a03a1ae9f32cf19a17e7ce13418d7d

  • SHA512

    754cf97270e7fc4697d791f704de7f222abf7efda5b79a545386492236ff78fa89b26b0119ac7402c8db1fe2011b7d0e9a8b8eb2d9898680624b4db7b879bcfc

  • SSDEEP

    12288:X4VosJEw28MeOU9g083yf0PQg3HScHvBUzCdSGYd9kS3LCg95v:X4ZJE4MeOU9gcAQsHScHpUGQJd9kSbPv

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2