Extracted

• • Target

    5f36f92cac06426f4cb0e7bc24688621_JaffaCakes118

  • Size

    910KB

  • MD5

    5f36f92cac06426f4cb0e7bc24688621

  • SHA1

    48d9b875108127d18cffdec0d15e894a25b59b19

  • SHA256

    f5382772bc0fec4e15e15ec3f7e3920a56f0f1a6860b74b3ce2c09266304c827

  • SHA512

    a24ef21ccf8aa5eb65ed1a1a2206b5ba36abc921575fa3eb6e8ac4b6f663268f942346e4aebfa1d18e46d216acf2f1f051393b4df6cadcbe38bd682ab708711b

  • SSDEEP

    24576:QwQ7siK3+nOY/ym1+mTZ4cWums1UZOklV:QlM3UYmlWHuzqOk

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2