Extracted

• • Target

    0210f5c67b236baf3a7d24fac1df359e_JaffaCakes118

  • Size

    341KB

  • MD5

    0210f5c67b236baf3a7d24fac1df359e

  • SHA1

    00b268be4214785b84fc776db50dcd9c4eb26c0c

  • SHA256

    2c2c9360e7100642c8fb53ed9e431690a368a70089989f137fb4df5b610c09c6

  • SHA512

    41ac3a4897ef25eb3a87bf2c4a0cb25a6d59bf8300a590e3f65ca75ebbac0e1847f4ff12f575f8089fac88cc1988cd396a9f248c8b7aed0b3779ef03a251c1ad

  • SSDEEP

    6144:ZDPlfJhQfeunG6zmltusf4x/NNZDTqUXN+67NmpwWnNKxy8wKOV5gKN6ZGpc9SJ:ZpgPGKmltjalSUd+6wpz8xBwFV2K6GpT

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2