Extracted

• • Target

    15067abeb8555ea7acb5153709700345_JaffaCakes118

  • Size

    420KB

  • MD5

    15067abeb8555ea7acb5153709700345

  • SHA1

    050c6d101fdcc80d482a85c15a0614b43648c075

  • SHA256

    9ab58ba189997223a9eebf59bb5dbc6bc24f10b5f7c9baa7c5772462fc182d23

  • SHA512

    48cea5e986d7fc465d4737570218bda1fb34a9deeac54c05a6a45bdde6f14bd39cf5b46d297407d09d69dc76a13d9c8a41a51b2c83fbf47d12132cb23b9043b8

  • SSDEEP

    6144:FeV5EEC5UGuSXPknmyNWtubss6ECdFUDMRuBQv+:FNECXcuZsi/UAC

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2