Extracted

• • Target

    838d507bebfe6b4da4f0754784baa834_JaffaCakes118

  • Size

    540KB

  • MD5

    838d507bebfe6b4da4f0754784baa834

  • SHA1

    9282d2c1bced9170415061cfcbeeffabb6b31d88

  • SHA256

    b203359a18c2e60b17eee28ae9c63904e57aabfd1d4ddbcf23afe63a59853758

  • SHA512

    540e6c5a440c2c67a51670712a27869d12a74473f2ff43ee19d9e30a0f6b5bc84e544a909624792aac17bea4d8cd60a062f0fa83b46e5f5a0385542bc3ded9cc

  • SSDEEP

    12288:FUJALxaQc86OV1/HFr2FzrN2IosPaEGPzTygkRdZ2h:FUJAxZVV2BN2LPKZ2

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2