Extracted

• • Target

    eaaad35f608c5fc144aba1e65d8bb42a_JaffaCakes118

  • Size

    376KB

  • MD5

    eaaad35f608c5fc144aba1e65d8bb42a

  • SHA1

    64fd98b0574426d24fe3e06aa0e8c627206d2515

  • SHA256

    9ef99d012c1874a6927509feec21d5ec4a5dc5516397caca9bc72453bed2ef6e

  • SHA512

    a9acca37debe85d554e0e1e0abadaf61769f85b53f4d4fbbddb56c44f6f9e8f1181e32327691cdc1a9977f80989f0d9739617c5319719c041c6ed1e135b18630

  • SSDEEP

    6144:2mcD66RNS5JGmrpQsK3RD2u270jupCJsCxCQIehh:jcD663Z2zkPaCx/

  Score

  10^/10

  cybergateãñíèç ãáíííííííæä discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2