Extracted

• • Target

    25806f32e1901878ae3dc89dd4d5ec98_JaffaCakes118

  • Size

    368KB

  • MD5

    25806f32e1901878ae3dc89dd4d5ec98

  • SHA1

    b05f81d6e255bbd1c809c5f2c8c9da9e9c1fa647

  • SHA256

    e3ee138d645164750f79522d1dfe4db33f98f3139ab69605e5253a4198c21838

  • SHA512

    5056be202b68cacee0ad36198d7dea6a8ece056ace55323515570c65552569bc1988de361e0d9efc9e45947169119282aacf3c5a5d01764473772a633dff6572

  • SSDEEP

    6144:I6Ng+fEjCsp6O61l5WjUic5fhSUFHOE1qa8CTDHvrX5jD5kk62B:IOg+8he5WjU1fczE1d8CXTX5Bk52B

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2