Extracted

• • Target

    211691ceb71cb2685a69a01dbe1bda98_JaffaCakes118

  • Size

    660KB

  • MD5

    211691ceb71cb2685a69a01dbe1bda98

  • SHA1

    b952dc6f20d1524798a799502a2cb821a6fc9c62

  • SHA256

    e7794e3fc456a5da291afe61a8fe57bbed86da7af3f43310fe0da10743410768

  • SHA512

    0d7a806207a00c8343586b0dd553e416b6604a8b27b8b261323bf4b070111c189fb1bffd2ec7d35227f828af4f346250e2ace998e58af64ddc905120b24e55da

  • SSDEEP

    12288:NHLUMuiv9RgfSjAzRty9jpJmAL090noHlyXc+XFuqyYlQ8H:1tAR2XwqnGCFuqye/H

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2