Extracted

• • Target

    15ad1ce5d652c56714e2ed69a142b8f9_JaffaCakes118

  • Size

    296KB

  • MD5

    15ad1ce5d652c56714e2ed69a142b8f9

  • SHA1

    964c9d374b2d77ac3117ff8033d9cc7421146d50

  • SHA256

    e2537a81d2658202adf37c9b8d84bfeb8569d423409443c11093147e35c6cd03

  • SHA512

    9da435e04ba492234722c5ef5d7b893639139e01b6f32393f252fbf7d55b494e620580e5c6ce467124be3b0705e59b318695bac2e746512f073f29762d3f6654

  • SSDEEP

    6144:AEgQuao3Fsyh8GWc7XTXpr3h4ii5SzYnuk0oxhhAXqJybrxWD3378:AWGvh887XTn475aCn0oxhgbrMD78

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2