Extracted

• • Target

    1d42870a7d71f2c1ee480a4f56e96cdd_JaffaCakes118

  • Size

    1.4MB

  • MD5

    1d42870a7d71f2c1ee480a4f56e96cdd

  • SHA1

    f07b5d0b18c07be368f95df2488b2aec74ba1280

  • SHA256

    cd017df379f179481e48610009530067ef0767e37343fa5242998c7bd8b7fe06

  • SHA512

    08f33ce88dc361f3b7b62cf423533151842bf5e71a639c96c7c759f8c01e2f1a77d4f6aad5358358f2af05cc39d657c340103678f2f75f756e094281c418785f

  • SSDEEP

    24576:9nalEWeNSaYD8lenbq6I8LTg6JArcyNzqOgyOhBgZTDipEW6S7joVFYlA9KJT:9naYG8lGqb8LTg6JGcyhqbvsDg6SnA9e

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2