Extracted

• • Target

    3e15e8bef679bb353ca23c80f4563b19_JaffaCakes118

  • Size

    1.3MB

  • MD5

    3e15e8bef679bb353ca23c80f4563b19

  • SHA1

    81c2be27dabe44ba11672a4fd8c771b107c8eeb8

  • SHA256

    d305675e59ba40808fd9454482f952bec51d86c488769a6967b4223539762ead

  • SHA512

    3ae9fb425752eca5499ecc91a32466c90f5203fa56bbfd54d5da9a174c996baea8526f7be720729b9ff4dd30699193288b1f47e1a76d0740e97ec07d87081faa

  • SSDEEP

    24576:0FPwlwYBN+8DjOnez3TND9dUUbKVUkXHnv9ZZkv9ytQ9MzgO73gj8ivI:0iwUGne/bGta89ZZY9Cw5IgAi

  Score

  10^/10

  cybergatevítimadiscoverypersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2