Extracted

• • Target

    a4e018dba1aadb2dd2ea4a463583fc6e_JaffaCakes118

  • Size

    451KB

  • MD5

    a4e018dba1aadb2dd2ea4a463583fc6e

  • SHA1

    db9b3968be8ec5e98a5e98ab2a06b0bda78a91d2

  • SHA256

    056e935dc9b3563763b51995eaca7d6818c5a063379e85d4635b1ecc9bff2c90

  • SHA512

    c4362c48e67bc93259b686b39c507e25eac307394ec35be6ab25dc12d399a7de703c47d3e75f31cf3ca7869f2907c1e2fffa383d9c6b5fb69769833199ec56b1

  • SSDEEP

    12288:FpQc+RPRD8gzMwcZj4L4oj1YPK7EaWLV6M3smnSvRTZ:FSdRQwriPK4aWLcM3fSvH

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2