Extracted

• • Target

    9976b9d3959588c00b0aa4d28bb4f3d2_JaffaCakes118

  • Size

    1.3MB

  • MD5

    9976b9d3959588c00b0aa4d28bb4f3d2

  • SHA1

    04e8ac4a43f598531cf92832d032a0d90d16b4f0

  • SHA256

    0798807d73577c85df8c0943965ae57017c2257a1e0dc03cf28bb5dc99fc034c

  • SHA512

    b357ac40630b2243af3f7e3d69e091880ca0465614282b803be60ff42f9b7646adc1968777d50430f0be5084b41f0b239396fb9468ab1365a5ee8000025ec31a

  • SSDEEP

    3072:9riaWGqhq2ZrPBbuF2/6lJvV6csowihB1oFBCoYhcu1k1xt/1hY9F6SOc0HjciU0:9rL/DKElezxQ1GggEiJU6Y

  Score

  10^/10

  cybergate][vxv ][discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2