Extracted

• • Target

    56a8e877d1937d5d437a1727e4eb5c0f_JaffaCakes118

  • Size

    306KB

  • MD5

    56a8e877d1937d5d437a1727e4eb5c0f

  • SHA1

    b48f3459b9c2425b76a9349d042bb86d22c24d24

  • SHA256

    521a254c46d3d01a2ae6f011779e08295b0d87cc8d80e577a7d742c86fd95412

  • SHA512

    4d74ce6144d0bdd73def138a572fdb9e0e32f0b53aa0021322593b4901f9c5b46d979d6f728f58deffeee50520699586508e3ef3795de15c84c27cda3df4b2fe

  • SSDEEP

    6144:uyXDserNwAXe3fQQ1uZKFmtHKmVw7J+x2mao0jLt/2bQPK3M8koG19VhwtPDt:uiweruAXOQQ1mKMh9wdG2q0vN2bQPjoP

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2