Extracted

• • Target

    405b05a9cab86e112bc401fec54fffad_JaffaCakes118

  • Size

    646KB

  • MD5

    405b05a9cab86e112bc401fec54fffad

  • SHA1

    a8368cc595469ce8b0a03b3031693f04c5ef1c2e

  • SHA256

    dd141ea8941a694d12652e919d62cc62afef307f1c642b412206fb79852c06f1

  • SHA512

    9b9512f0eae12abfc862cb1913dc87ef9b0771f60c4e4ea7bd519d2bd0a1e2a70882e685ab64f1726aca4243f2ec2b25f3a0e79740f52e050020cbf9b2fe1209

  • SSDEEP

    12288:+YcN4UcDWoW+lWt2gXKv/uoQ4aUXl3wtsXPcnzmeKgQpqV3IF9D5LfV13yf:ndaqW8gvNO3wtykzmrgQpqVutfVW

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2