Extracted

• • Target

    9a4870e30ebe117357fc25bf63469751_JaffaCakes118

  • Size

    738KB

  • MD5

    9a4870e30ebe117357fc25bf63469751

  • SHA1

    c95d160ba5ea6457cbb33a0a4607264111186bd4

  • SHA256

    e19725ec47fe278fcae4d04a49b1c21f4fd02bbf38d0e1f64f06df806c95470d

  • SHA512

    bcd5a4e4f5358573245f8a7f8a5f43be1ec58dbf973ab6e558c2db00a38fab72e43637ca91dac87afcc240e30db3596565bdd218d54d762c0d0f502dac2faf5c

  • SSDEEP

    12288:JYO7zRK76AODrLgMAtYvpYSznsbUnp6dHERiylEolz8mSTVhvT52:JYO79K76AOPcMAtYvWFIqHeEolwmgY

  Score

  10^/10

  cybergatevictimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2