Extracted

• • Target

    084426eaff7d1a6538ec24b10c410d11_JaffaCakes118

  • Size

    1.2MB

  • MD5

    084426eaff7d1a6538ec24b10c410d11

  • SHA1

    bf322c00a4cd35775dea99fb4ecf017b55a3e119

  • SHA256

    e70855919c6f1db9f731e7c9bf2fa65277284cfdba4543f6eeb54a58475dfc84

  • SHA512

    f8c612b8d10cf476b0e81a863bedf4b1e303f43c73b90f8e02fcf22c5a3fb4cf317ea9efcf857a25af5c47257b37b22d98b5f7b9d111fb37d63980824bd33f54

  • SSDEEP

    24576:el8QfAgftcJ+ux0xGGcHjYEwIafxobjevWxW8YgLlqY2wd1A1EDOTr:u8QfAgftcJ+ux0xGGcHjYEwIafxobjez

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2