Extracted

• • Target

    4eb5f4fe1cbba012b23178041f4d2a6f_JaffaCakes118

  • Size

    394KB

  • MD5

    4eb5f4fe1cbba012b23178041f4d2a6f

  • SHA1

    e9d6ecb69437ba6c76b272c694f151b7d584aaf1

  • SHA256

    f16aab5d61fe989a339e833eddc53807d3a888b2cc7dc7cf958648fffbb745dd

  • SHA512

    e705f7a4b2c708cfbf50a3a5894eb228dd45cfd9f67bdd6369f9c27de373f4a68d04d18820b24dc0ecaee8b33e625ad347f0ec72505e9a2eab11c163a37006bf

  • SSDEEP

    12288:8puuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuIuuuuuuuuuuuuuuuuuuuuuuuuuuuY:Uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuf

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2