Extracted

• • Target

    780b1741e475eb6b0afb1c2ed0be0267_JaffaCakes118

  • Size

    314KB

  • MD5

    780b1741e475eb6b0afb1c2ed0be0267

  • SHA1

    d3fea71a0affc16357ef9491d3689d2786ed2718

  • SHA256

    e1fb189d01dedf0e329799f0642bf2cbdb259df67ebb49345ad717a175e8a771

  • SHA512

    3c7eb0d3912d6815bd428bcc017dc8f18946b2a2f0145f696ce57638b7a800167dd67e9f979fbea823ccb5a859dc27ccf13383c0e7809f85de8d13d021fb6753

  • SSDEEP

    6144:R1F5PhbV/Z1kDMw0PwZ2PJtTknr/+ftwR5rtTgE5B2b3Kv:/F5PteDMrIEJtY6WR5Cjbav

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2