Extracted

• • Target

    0de24466a5b1984f5728658c664df4a8_JaffaCakes118

  • Size

    322KB

  • MD5

    0de24466a5b1984f5728658c664df4a8

  • SHA1

    1119de1f624fcda7375b3bab451cd57cf45da2a7

  • SHA256

    e9ebab9a42077f8d1564eb832fb9f0ba9119ca6008fad3159dc580964087a238

  • SHA512

    07b916cc17257f75e7e00b7ac10e2b2650b07e0094a903d7a6192569cc9068518f61c04f4769bb6a42a692320bdce4d3f98cbf5e69288bbecbf7a4cb046d95bf

  • SSDEEP

    6144:ClKCb8KgFXi7aVPhsHMwq2VWU/5kWjRJHbBYseP4fJpS9snJ4rbDMf1u:JCbDgFXrvwq2VWS9YuJp5n+DOu

  Score

  10^/10

  cybergate524discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2