Extracted

• • Target

    a15878fe6b29e197dafe057c22fa2551_JaffaCakes118

  • Size

    547KB

  • MD5

    a15878fe6b29e197dafe057c22fa2551

  • SHA1

    32ad97dc5ccf6c3f44c3a7b78ace0645de6dcd33

  • SHA256

    32148317b8f3a1b454ba7ab3906d4b86128fc2b38c705603f09f8a598bf775ac

  • SHA512

    9e40256fa93d4caf42dedd9e951de587b24c3ee3b396d0a0c197f93283fb1399b36a02de3bc4defb0c14202711e5233239d6959ec5d6640791295c725bb64ac4

  • SSDEEP

    12288:H8sn+DYW8EMOpVO5gFOL3YoSGKGWpmx16Ra/DN4VHJ40:H8++DYW8IQ+Or7Ja0yt

  Score

  10^/10

  cybergatebellodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2