Extracted

• • Target

    ebb739a8d9b4380986ad58a20f420683_JaffaCakes118

  • Size

    8.1MB

  • MD5

    ebb739a8d9b4380986ad58a20f420683

  • SHA1

    1e8212541b76b3646d869117f99159f6cba20707

  • SHA256

    700de744f61ff8d6374ae8f29a74c4c5b1ce5d2160bcac46159d86afe173bfff

  • SHA512

    1809bf0ff1b5e81ff4a7e06c2e7b0c8c47d73766bae8ebd98fbe162a6ea2dea2076b88eccaff56f7b8573d2268997cbfc75d6c67b1071bd2261ad3cf42195ac0

  • SSDEEP

    196608:XwYdPLmb4FNuIXcsJ/I8U/uTVwbsQeyVsjcSQJ7:H1L17a6I5/uTVwbEy02J7

  Score

  10^/10

  cybergatecheatsecdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2