Extracted

• • Target

    453c7be79b68e11e2464335f5a20471c_JaffaCakes118

  • Size

    1.6MB

  • MD5

    453c7be79b68e11e2464335f5a20471c

  • SHA1

    deeb9045ce00fa14dea520ff1b66cc5142afbd19

  • SHA256

    6db8eb9059af6db431e0a3db375b29877874759426e8170a117d57a1a8d58375

  • SHA512

    7182c90bfb2dc073b401ce239d6ddbf6ebac043c0317f217e7ede979657dd741622b97d5220e6d1517d00ec90368e4d00b7272804b131ef3b25228fcd1158d08

  • SSDEEP

    6144:W9I63H5TG5O2MPTbNJLVLYI5Q/+FN3+RViWZba4O6mEIjNK8FYB52KyaMF:W91x3LVLS/qN3+aWsF6ZIp0i

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2