Extracted

• • Target

    191dba079e2070d30427480a7ca6138f_JaffaCakes118

  • Size

    324KB

  • MD5

    191dba079e2070d30427480a7ca6138f

  • SHA1

    67c4905db8b87080939e660fa15045699183063a

  • SHA256

    5ed74f729b826e0ec22159ab0ccc2ecb7f4b9f93e52b07edd804d0f9f8189cbd

  • SHA512

    887ece62130254dfc575beac620873c6f7877d6e783d56ea3cc5ee2ede8ce25655456a3f3c8e2d776663ec3e40428e28a2fa7b50d6555453f505073d22d4e685

  • SSDEEP

    6144:Pf4jatiiWlRmKRvOpD40/MnXxooQX9Yhc7jCeZIjf3o02oWbGmD34:34zHmQ4D4RXrEYq7jCe8fVWbGmD3

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2