Extracted

• • Target

    2a0840b5c1acd220f196b2d8ab444aa9_JaffaCakes118

  • Size

    448KB

  • MD5

    2a0840b5c1acd220f196b2d8ab444aa9

  • SHA1

    ebb9db01195c473e569ad8d2c32bb7af6bc48a18

  • SHA256

    62ff11586276830169b1aac55b28fef5a3e7853d7753a046048c875dea702077

  • SHA512

    266039145548f3064abe21b2158e060c6dabbff447b560c0f8f0bda8e43b88c2b6f481e2b19bb214776b455aa28952001c01ad27119e22229e21a5c36d4b7431

  • SSDEEP

    6144:oyIZI0i+R3y/IRmkAVH1r2MHEv9/PuGYQdxyktLC6N7EsAC2F3cNB8:cD3jAVF2MHIQQttW6SsQiNB8

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2