Extracted

• • Target

    3daa5fb73a24d7643fa0e96ad142dc1b_JaffaCakes118

  • Size

    343KB

  • MD5

    3daa5fb73a24d7643fa0e96ad142dc1b

  • SHA1

    3c5b4e08e750b5875f05d1b074684e3b5144593f

  • SHA256

    ea1775daee62c7ddf5731e728954ffcf10dbea0b4df6be1a46b47f23a314d7dc

  • SHA512

    1ae8c8ea920f25adec98c26645e8c76259e1e5126e4448760b7d2a8752289a318bd687bca39942305c33f61df075d22d43f19572c352abcff6d64989a0106154

  • SSDEEP

    6144:vHOLo9BKTaEqhguQVFWxVTBUNdCvdl8B545nJCSzZXvR0gw9VtNuw:vOoHAhqyuWUxVT8dcmX4vCS55wrtp

  Score

  10^/10

  discoverycybergatevítimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2