Extracted

• • Target

    f70033ce2dda565326971521051d40e5_JaffaCakes118

  • Size

    784KB

  • MD5

    f70033ce2dda565326971521051d40e5

  • SHA1

    9b7a5f329c3e0debe6445689cc84c86939652c9e

  • SHA256

    c44f450dc6ebe795e9d20220541dfaf940cc31cab4930921e73d923810a15dcb

  • SHA512

    bc5ab697cf1989f66fc7bd11679b866fe185b60ff34845687ac7613e07f795e731ce43428f8a1c8dbe634e98dc4519a14012d298bc181cfe2e65f834a399d21d

  • SSDEEP

    24576:YkrIcgXIR/Hocti9PZenEX1yCW3tIRc01bT:Y2yXIl/1nEFyCWdd05T

  Score

  10^/10

  cybergatehiiii abodediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2