Extracted

• • Target

    9ace6d318d293d674a49c23d9bea31b3_JaffaCakes118

  • Size

    356KB

  • MD5

    9ace6d318d293d674a49c23d9bea31b3

  • SHA1

    99e5e5ce1e60293cfc93487ca76193bcac15df51

  • SHA256

    bb01e0ace5c29f4e0cbb87bc8bc811f4e7f1c29c6c536e808e4a0195c4f3a462

  • SHA512

    b212896cb1e9a4f6c3037de59a9e85f101782136a9cebde47074d9c8987a35e38c243044bf898e5c68846067617128b18de285266b5a8b8e794c7c7275c07cf0

  • SSDEEP

    6144:JxMGCdSbogezNxH21hXZcZuIvqwFLk7dqK1iPnScxBwQ9nHHtjaH8ELA:JKsoguxuXZcw4+7JkPntXwQ9ntjaH84

  Score

  10^/10

  cybergatex-01svu-xdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2