Extracted

• • Target

    603fa32d6d8004fdba90e4caa654bb00_JaffaCakes118

  • Size

    752KB

  • MD5

    603fa32d6d8004fdba90e4caa654bb00

  • SHA1

    ec395f9535a514cdd8f7a22d82d9f89c2b34b463

  • SHA256

    0a9d3dc9afdd595d77de1d2f448c16e63dbb35fe3d355b2c3446881b8a28273b

  • SHA512

    6f7fb72860726e382f44eeaa017d34fb820f8edb1d543774abfaa21a9f561060b818471a858cab36e1dd607fc39ab12e30dbb1468690ee116e5609028d16b2e9

  • SSDEEP

    6144:r9wEFMv6M4YCUrdmFvTl+G78hxJ0Q5U629Jq+NHS2EzjlJUP9qFvIrnHtl4T64vy:r9gIqxGQ5U629JHTEP/tFIHtlD4vDfO

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2