Extracted

• • Target

    28c1529c80cc880dd6115e1a77da925b_JaffaCakes118

  • Size

    310KB

  • MD5

    28c1529c80cc880dd6115e1a77da925b

  • SHA1

    0cc70940fd0170b8fbb44a8221a5c27185f636f4

  • SHA256

    c992ffeb0142951a5eae7b8f1b510d3129ce421307fb260807f617588531322b

  • SHA512

    e9d8683cb7e35b8a1a797d62e6c8a7f679bc36d96a5a472955e85ef4113251ce8a73b04af065e6f2bc4dac1db7f188d2ad74f2632cc520ed9f29aa8946751019

  • SSDEEP

    6144:kRdWXxJrt0DnU37C2xzsIOLV9Dd5LQ9dr9mesM999xlI4q56WkvHUZw:2CJxN37CGzsIcjDdl6dtsG99j7qZW

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2