Extracted

• • Target

    ff3b7f563de4bd79698ca6e2ee3ca06a_JaffaCakes118

  • Size

    548KB

  • MD5

    ff3b7f563de4bd79698ca6e2ee3ca06a

  • SHA1

    06e5eb41bec31f468229ea93a54976dc76eb4ad9

  • SHA256

    ffb320ec60c0a19ad1a4a3dddd22075c6e66a94cbef4c321a6d09f5f3a36ae55

  • SHA512

    29e2ec9acb0e011ed297b6bdeb1304ebd70593ec85b7b63ea89552ac05ed7f791797e79db7eb400cd4e08064e668ccfc2233bf6981ba0945ed16e83fd0a62a11

  • SSDEEP

    12288:DuqrBDT27EdMxsygLDeFCv+WNCR0oX5M/k1:DxrVBd4lZjXB1

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2