Extracted

• • Target

    4ac58f4649aaa7c89b9edce8899949bf_JaffaCakes118

  • Size

    335KB

  • MD5

    4ac58f4649aaa7c89b9edce8899949bf

  • SHA1

    26eb0d116596924b737e3a095506cfc1424ac942

  • SHA256

    bcae914b4760b79ce0a6429118bdaf6d82023d7d59e657f78f0e3bec7d0d8919

  • SHA512

    1072588f031af1f678c7eacd9adf93e2fb6b2f4a798cdf3c4d89a09a619a5e673149593fde5ce9a3035ec57c38dca244bd9c3b33e043c98af9085bd6e777e572

  • SSDEEP

    6144:SqO9msO8TB7qNNsqmS0bmdCLze0vmGwQbNof/YpBuadEHzH16v7vdMqivqQ7:imsXT4jsqz0bze+VwQIiuHH716JSn7

  Score

  10^/10

  discoveryupxcybergatevítimapersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2