Extracted

• • Target

    a216337e03a0b7052bef6ffa72d3ec1b_JaffaCakes118

  • Size

    344KB

  • MD5

    a216337e03a0b7052bef6ffa72d3ec1b

  • SHA1

    262d9475a5406280686c301840a6c8e2e3066db9

  • SHA256

    4a921fa2217906f0ad8ccce6c747d288f5fd3030d600c2f4cbb85fc471093e00

  • SHA512

    f14dabf7ff80b532a110fcab0e591e0433b69e3c94639af0a6d59ace357b1f82e3b608c9b167ced0268165ffa34c7cccbecec0bf8cf88578ae8a4253e6434fd2

  • SSDEEP

    6144:SP0GJdKIHlLHC94TIyUQthVf4Hxv1E9su+Z5xGAbd22tq0b6d85mg5JpAx:SP0GTFWIIghVwUqTO4I2Nu7ipAx

  Score

  10^/10

  cybergateóêðàèíà_àâîñüdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2