Extracted

• • Target

    732737b141ad16536b45b265707ad416_JaffaCakes118

  • Size

    332KB

  • MD5

    732737b141ad16536b45b265707ad416

  • SHA1

    2e7c071ce3d7c56144b67e314d9ba8c3a3826291

  • SHA256

    c2875fcbe280a26fc621862a5c60bc3895759e36ffaac59a92de1277bbb2ace1

  • SHA512

    3f8fee56ce90b7d7e2666c8d009cc5927239288e3fcfaedc2f87991c78a1d30a2db08d9c62790de230b7d583e301f6a7840a7cf88ed01ee9dfc8058b0769dbf9

  • SSDEEP

    6144:lepYdwW4UWAXbBM6FOJOWyuqzvim0++n5JX5mQ+I2oicYwTd2:Yx/6FOJ5y/E++nfJ14oIww

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2