Extracted

• • Target

    9c1e224b687b3db1d98aa17ebc8236fd_JaffaCakes118

  • Size

    1.2MB

  • MD5

    9c1e224b687b3db1d98aa17ebc8236fd

  • SHA1

    1afd1eee8523e5802298b04947b058085207da61

  • SHA256

    a0a40c68438e8afe6c97cb2bd07e12e4b6a2c05fcda7aa592c9247978b12731d

  • SHA512

    4caab7b275c1f5edc2fe8e2a6748d2c1794268998cd75f9563c7a0377bd79c7295e6ade276ee125358fe330f9b670ea2b65a3ffa8db27f5cfdc6759e1d0d74a3

  • SSDEEP

    12288:w7q+l1B/mNexem0gj9UB/ttPrgmpWXXA1f4RGZp83QxghykaU6R5Px2ZzidB6mPr:wvLBOxg+fxgoWrRLQwSp5iR0A+caln

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2