Extracted

• • Target

    a6158e13ba7e9da6a55fb7a755d84ea6_JaffaCakes118

  • Size

    448KB

  • MD5

    a6158e13ba7e9da6a55fb7a755d84ea6

  • SHA1

    66abda69bb85f1bf1dad1f068dd29507d48b5abd

  • SHA256

    e53738234f54bf730480399562ebd36b7819253ebad00b0e924947016c50944d

  • SHA512

    55940a7c9002376e3e724c82d1041cb0f33ddebf4210ea9a70d4c3a24d099667f14cf7ae3b846cb21b8ebc24583e1d64225d4e3fc1aeab2d5742a1b7a95e1b93

  • SSDEEP

    12288:1KVoguxuf+Px3sCucrO0zT3DA92NKx3+TDWUg:YVNuZZsC73UwNKB+/H

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2