Extracted

• • Target

    0317a7194af5d6824442d441d4acc7a4_JaffaCakes118

  • Size

    395KB

  • MD5

    0317a7194af5d6824442d441d4acc7a4

  • SHA1

    3da1a9779f3122315d1350146219f6fbac6ceba6

  • SHA256

    85421705274eafe5961ca44e4d9a4f73d6a2de6347de3e35ab9c5d5e3e0569df

  • SHA512

    0d1cda951a1969cc56613e64b791548c959cd5cbfb11cba4ef4ebbf3212ac026ca88662ba1c83160cfc07ed37a4910edf9e4b95e92fcf2f4555dfb0828cd8ae9

  • SSDEEP

    6144:Ck4qmOhJidJqyZOIPKidknKwoFLn17lBojqNRlVVIQKiw52PyTTEQHEs:997nyZzPKi2qLZQjGzIQS2y4QH

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2