Extracted

• • Target

    1827f0740daed91accce0e3fed95cc72_JaffaCakes118

  • Size

    724KB

  • MD5

    1827f0740daed91accce0e3fed95cc72

  • SHA1

    3fca5cdc259ad7098b00392d75148dea2bf7382b

  • SHA256

    bdfd1f3cb54a3892d5d35f1a69c1952e2fc1578415bb9444e66e2c5d5759b0a8

  • SHA512

    1a606d008c2579a455647a5909cc9f80eec19b0c90c0e44d4fffa824a1cb2ebb12c7f09d130b17da3c05e347d7e11915159db2f683ce6e1ab2daffa75a43fa6b

  • SSDEEP

    12288:nF3A1nJJjdpuw6u1TiEoZEaBGg7IZfJRJFJbbWFh7ojNH4QQniPse4:nVAD9df6uJQEcleJNYQGi0j

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2