Extracted

• • Target

    5fddff523e02967edc186a4ef141a14d_JaffaCakes118

  • Size

    1.1MB

  • MD5

    5fddff523e02967edc186a4ef141a14d

  • SHA1

    bad8ec0ed851733d9750620facfcf4ed454677c2

  • SHA256

    f0c15b1b2f3d471cdd78688fcbb1b744949c20133dfd20f50bc97178a7b217f7

  • SHA512

    d5068905b66dd09bb53ac4e1e4824dba82af9acac7fb64a21cd1cf90b4d783793f2915bc62e9af5f69a5bc8374436dab2ce65b726b65ae53c42e55fca37ae015

  • SSDEEP

    24576:ZnMwQgsiK3AcIXFFf5uiuJu2+xDRnBIuHFS/HDA:ZMlR3uhc+xDRn3Sc

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2