Extracted

• • Target

    23d668400eb206e07aec81ba0214f1b2_JaffaCakes118

  • Size

    376KB

  • MD5

    23d668400eb206e07aec81ba0214f1b2

  • SHA1

    7dc342be2bccc152970b0e4933e0030ff7d64c89

  • SHA256

    15fe7eb566da63070cdc742f7c3c84a74e5e271f8dfd9eece2e2a599c5b7e5bc

  • SHA512

    a4f89b426aefc65775989b370237a9e40c5e880d6c6f605512e463cb03ae78816d43f6e121c299cb859e49e82d00874c77a2da81ef4c5c0d8aaefccd4d983ddc

  • SSDEEP

    6144:EKEJobtPfDhRybAFVV4lK0CaEyJPSrgqtPkazTfTOp0H453hfy9Qy:HQobtXDfy0FQKFd7gq1zTsp3dy9Qy

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2