Extracted

• • Target

    7c4681d6655fbb0f3791a918c7ae38b9_JaffaCakes118

  • Size

    363KB

  • MD5

    7c4681d6655fbb0f3791a918c7ae38b9

  • SHA1

    9ccab6ddfbbc4e5def1ff44270777c8301b54bbd

  • SHA256

    9688049fa2480f0903561091fef2a532529432178fdc05056f3c9034f678e691

  • SHA512

    0e214737224e5d8e00887efe7190813682d737982d4c052a816b5834fbd0486696bafef69cabd0e9d23516d5a5a28764b86008e99c022ab7f9bfeb6f11d2354b

  • SSDEEP

    6144:fI/p84y4iXL+w+TDW9S5STslHy4wIUtPPjyaJejVGDQXMvwLdd2DU:fEylbyWU5rhUhbys0GDUd2DU

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2