Extracted

• • Target

    4e350b017b9508e698be2f56d74a78ee_JaffaCakes118

  • Size

    998KB

  • MD5

    4e350b017b9508e698be2f56d74a78ee

  • SHA1

    fe9a434e4e754a8da95afbb055255e238501b447

  • SHA256

    9fee1c16424d1e935774840dbadc5c674deec263704f31709f9d75710e17b474

  • SHA512

    e38d1e27a26b21349a826d66697e653b8c32f6f6f04258def304e2ca294f47b9685ddaef32da4c1c32eab2a2f6ea71d3afbfb22e14238202d1b516c9fe109cbc

  • SSDEEP

    24576:MafIiy4NwdLTtCYVwTsIrxR35HVwxDekFi:Tffy4NwptCYeTsIrxRtVii

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2