Extracted

• • Target

    27f783e044d756c8cbbb2ec340c00ba1_JaffaCakes118

  • Size

    294KB

  • MD5

    27f783e044d756c8cbbb2ec340c00ba1

  • SHA1

    21ccec1fa044fa7ac1edfdc3d94bd8c5f67b5697

  • SHA256

    1a2b043e63fa2fe4dcb65fbdbba02630c727835dae55a75394397fd2ca09b0b7

  • SHA512

    916dd44638437b3077ab4fdbecbb0952b31933a8d89d2801ea9e56f5e12451b66373fb2fe0d32bcdae8cb547479254896518517d7c1e121b58448358ceeae106

  • SSDEEP

    6144:rvKH0vWDv+zarx9piUTjUUhqatTs2lIqBLTA4wxbPmSlJsR0I:rSHZDv+zaN9UVcTblIqpT7wxbtJkn

  Score

  10^/10

  cybergatevítimadiscoveryevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2