Extracted

• • Target

    e0eb733217842b290a145ed012d9b24b_JaffaCakes118

  • Size

    389KB

  • MD5

    e0eb733217842b290a145ed012d9b24b

  • SHA1

    efe0175f9ede848e68c6c5eafa2ff7e888aebf42

  • SHA256

    adf9338738e2acf89e5694081415581234f5a5e1dac2fd6497144d722b06351a

  • SHA512

    80575da34f540166306cebbbd1ccbb910dfc4b3383d1ea329cd363c8b38cf4da3264b2c473746b00b17bb262f689487e8432568d16e3c40b33f6989bb7f398d7

  • SSDEEP

    6144:lsSdAFQDwYo5x64X0Rh2f7gcQ93v5e2+8EM/2eLHsREB4zCtMuIdLBPtdzWIsbEM:lsSeFW4Gh2f7e3Y62WMXzaRIhfpWFbEM

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2