Extracted

• • Target

    457cd8b2c7d5414466942d3476b0ac88_JaffaCakes118

  • Size

    400KB

  • MD5

    457cd8b2c7d5414466942d3476b0ac88

  • SHA1

    eb0963c8540070d6b89b90806d8ff5e7a7c8872b

  • SHA256

    b1c850c09e90b33e312a47e74045ba3f38881e04dafbd5813b44801e101cb0ce

  • SHA512

    3c10bd52c6b30d65da575be531655b31a13869722f7ec6b4e8fe19690a571088dd839029269f9e4b41c11a9a064b91fc1f46c3704c41299dae31eb04de95433e

  • SSDEEP

    12288:vjR6cpYL1jg9JMaafxQk2Ke7SxxCUQtu4:vjR6c4s9CauekN5I

  Score

  10^/10

  discoverycybergatevítimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2