Extracted

• • Target

    1bd6f2ecf1190edfb6282aa9d27be2a6_JaffaCakes118

  • Size

    305KB

  • MD5

    1bd6f2ecf1190edfb6282aa9d27be2a6

  • SHA1

    67cdb36fc56ffa7391134da4f66c5c7cd30b3bb4

  • SHA256

    62a770c50921bb6b3b08e944c418254e04439a236a333ad8318105fd571e5dfe

  • SHA512

    473160a47c75f72c103eeeb71de184ade8e135f53509221a6326b3e91ee68f24ba244cd26f5ea5e7bfbec26daf95a958a92260f321ec69db8266947d86f20925

  • SSDEEP

    6144:D724ToFyJEy8tTNzkrzmqUCQVxwhTtmOLrGQ+gd4DHJr6sBeDwb2EcxWLJvY:32F0ElHzDxw5tm0Igd4wsBDjxY

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2