Extracted

• • Target

    084011d82bccf8bdfe6900d5e2b6362a_JaffaCakes118

  • Size

    371KB

  • MD5

    084011d82bccf8bdfe6900d5e2b6362a

  • SHA1

    3d6ab03e367c9aae8886855bddd08407f88ddbbc

  • SHA256

    6e5c277cca0d806c7660aae2dd2236e208a297a3690b890dbb5b9d76c19e1218

  • SHA512

    1b73bf833b718b86b9c3adab3544339f04a4d8886473281451119d9fa815a40da951065a4db29f3ae922ad98a310afa83a5659344c4f782dd4cafbf654eb539c

  • SSDEEP

    6144:tjPX0oe1wu4OMDsF/5K2i4DGsvCJr28YnrnulUkaNhTaWl8oxs8yNC6u3rH2Lard:tT0o1QF/5ZiTsvCN28YrulUfNhTaMsq9

  Score

  10^/10

  cybergatefcprivdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2