Extracted

• • Target

    ea195ebe6006205211a67f9b79c2d476_JaffaCakes118

  • Size

    1.2MB

  • MD5

    ea195ebe6006205211a67f9b79c2d476

  • SHA1

    8b7ee184540c979b2925fbc0e59a636cfe0d6faa

  • SHA256

    16022c4e26e9711b50cef2ebf4e877c6d9ea411d3874d1472e0fc5316e44be8f

  • SHA512

    9f8ddfea5183a33218c85c44b97f7ae1c438557138b17009421212db1e2d59383d39a9c334750255f9b167aa0f7d6c086952f5e2bd52d1e49c06a9c7795493a8

  • SSDEEP

    3072:n3vfsVJmsxPgV+CVFGxuhz9EUs5sBjKOfNPMltXtQIt1UWqn8zRywZt15FlBQINa:3vfFo39woJ77Vg2J

  Score

  10^/10

  cybergateamfdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2