Extracted

• • Target

    6c3a9ed6b46572d3f5093574c9c34186_JaffaCakes118

  • Size

    916KB

  • MD5

    6c3a9ed6b46572d3f5093574c9c34186

  • SHA1

    ebcf05f236e0d9a25153bf4079987861a9106188

  • SHA256

    b1981ec869c6bed6a200aff3588535ab4aa777311358e8de5d3c1a20987c02a1

  • SHA512

    27d83d24df82c557307143acbd86d9f65a33c8f37e2d10bffe29059869e488e12cf5e72444bc34cd2fffa6cbd057331dfdaacf700fec6ff070ff5a04a7b9502f

  • SSDEEP

    12288:02ie+ijqVB4z8HmxIqv8Ufa80ZwRctFyw8D:0nGxI88vwaWR

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2