Extracted

• • Target

    f5da440f7139c69b254eec71e9cf2214_JaffaCakes118

  • Size

    679KB

  • MD5

    f5da440f7139c69b254eec71e9cf2214

  • SHA1

    94b00c79f2d5299737d1d367a043681a91f930e0

  • SHA256

    de2f3f92269f376036d32d964d702268e1110ef9de28e8af98fefca9e1377217

  • SHA512

    38c83c4988b5b4a385003ac62a8a51c5e7903b29fd8977a294630d0c10f01bcab822d732b2fdb4626158c5e938d87f397cfa4ab0fdfb657cb05783cbdd14b9db

  • SSDEEP

    12288:ZrsVJA1vSI7aG7DuF7q95INmQ2UQFpQLZk2sgtwYwm:eJgvL7ZmhRNmoQ2NNR

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2