Extracted

• • Target

    98a5f61f112ec632ee4ff7eb0c3fd699_JaffaCakes118

  • Size

    1.4MB

  • MD5

    98a5f61f112ec632ee4ff7eb0c3fd699

  • SHA1

    b5a1f33e191c94eb5da5a605543a9a203d261472

  • SHA256

    e7893e1c8e9a8590bdec7f3b2286becc27a8c36fdb14ec3c3bf23785873eddb4

  • SHA512

    137b28125b84dbcc7ecc2c411d924e532e71a193e2c0288e760c58a8f010d290b2bda45ebfc4595324ac923a58524711622759e625c7445ec68940ee80a24857

  • SSDEEP

    24576:oY5sVXSVwDKpc0/ccymXJxtFSpUkytTuISZjJkw5OzAAKCvMdwhDMCYIoK:oYOVXSVAIcOym5xt+Uk2iISh6MGhIx

  Score

  10^/10

  cybergateremotecredential_accessdiscoverypersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2