Extracted

• • Target

    9edcd10eef30eee0315732ac3f22a717_JaffaCakes118

  • Size

    379KB

  • MD5

    9edcd10eef30eee0315732ac3f22a717

  • SHA1

    1c9766b8871a607a9f400e6a276c9865646f63e5

  • SHA256

    4580ae34fdd3bb1b72ab5a734a74356ef68d8df0d1d033334ae966c61fe228e9

  • SHA512

    3168f4068de89333fa12670ff2acff8cebd789c0c627438df75dad58d85bfd6f1fcce5bdfe09b8f07c560856d7b5a33b5c4b58bcef9da171ce5e87263496a2ae

  • SSDEEP

    6144:N6ZxARAW+fYtScitAW9DJ1ECOCHaR4UDFJWo3LU1Zpc3nT3QZ28a/Tk:N6ZzJnF9DJjDnQFJZLwZ+3nT3Q085

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2