Extracted

• • Target

    183ee496745828d76da3c587a27f7edf_JaffaCakes118

  • Size

    1.0MB

  • MD5

    183ee496745828d76da3c587a27f7edf

  • SHA1

    13a351311ac9e2faba149f04d43b3d59645f1240

  • SHA256

    0e0badeec4580987fd614025f61e96ec3a0f48934989322b37cf19b3369a264f

  • SHA512

    659331416a9984b33a4c7535595dcfd58051acb077651d98f2ac32751b9f6cc6604b96b5219d5211bc5222f8cbd2d9f516c93df74ea9f37a3945455171bf502b

  • SSDEEP

    24576:dmzzHpBxBB5vBD1vCfwEEUAoMeSerIc5cs5RwMA8Xdb88Q8gsYgSyj:uzJBN5ZD9Cf7hRUc5cs5OMxN9S2

  Score

  10^/10

  cybergatevítimaaspackv2discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2