Extracted

• • Target

    85dd53618ab24b5879010924e180ad70_JaffaCakes118

  • Size

    304KB

  • MD5

    85dd53618ab24b5879010924e180ad70

  • SHA1

    c72a7c60f38ed625c530f2f0b22135211620f74a

  • SHA256

    af86d479458d2c81df664d6a793a5eed2af39e0eb7272bb4bedcc0c6818d824a

  • SHA512

    e131e06ec529f808c547e861c9fe3f1386106eb75519d094adc42437db4519fdd736e8c2196e099cb96b785e213684bbb46ed9672b533da0e7d272b77e459834

  • SSDEEP

    6144:QkAZiYg2vMUjzIy9biVpgVgaVUO7r8OmBOYqKHhTERregX9NJ61I:8cYVvMJyAgDf7rvKaTX9r6S

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2