Extracted

• • Target

    553b341e00d9ff335bd4915c3bc27bc2_JaffaCakes118

  • Size

    546KB

  • MD5

    553b341e00d9ff335bd4915c3bc27bc2

  • SHA1

    f27e428e0f9af6c0d4ea0265a8afcedc8ed539df

  • SHA256

    e6024ec920d940ea105d7060deac847e8b76d88006e3f0af6eaf181f04ee52e6

  • SHA512

    724a9829617230577abcf97fa8a944e96205531371444ad6b5084e5892acd0840299017db70230760bad58bd55cf92c3af0c283143ef10bc6653a2acb42af4f0

  • SSDEEP

    12288:VgWOCYaPcR6/5pKDdlwtRPcu+DRMsZ2zkPaCxl:VgWXPO6BpKDDi+asZOklH

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2