Extracted

• • Target

    4fab7e4b1bcd02645da063dc1cf37b42_JaffaCakes118

  • Size

    312KB

  • MD5

    4fab7e4b1bcd02645da063dc1cf37b42

  • SHA1

    f38dba28f631ed73e0c8be859e03780f1376b54e

  • SHA256

    d6ea7952d20322c44895c47a745312a4db2268529a002fe31bbc4ece34657383

  • SHA512

    1766bf77130659b118ed2ae7d97b1c0057b9d2d8800e592e74d1232d7f5481008ad6a674adf856967b693059468c30bd61d4c22390f87cb8e67b89a8bcb645e1

  • SSDEEP

    6144:6qk4qm3FQqe6WctaX1A3bFkeaxkjNDZr5P2ygpreK:49c1tkX149aaNd2Xf

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2