Extracted

• • Target

    a954bbf106bf33c7a9c6b84d665d1c6a_JaffaCakes118

  • Size

    703KB

  • MD5

    a954bbf106bf33c7a9c6b84d665d1c6a

  • SHA1

    557f700224647df766a7a6132897893c876ccab3

  • SHA256

    497549771b03c04badb8091ba4c657fa636b7095d1e15b97470d0ece4576a6aa

  • SHA512

    0b9e03913c912252f7d0787d1d81804ca2e5da0ac46a1dd75226376acd6f9170cce77deebb57cfada75b64d8adae77a66400ad9007ced3ddc594074ef384dc78

  • SSDEEP

    12288:Qmoe0wVY0DJeQkbtde8yQXhgC9AEeUaSsc09JGg0NOuRYYMe4QOor5ASYKFbSRR6:3oe0whD0Hve8/qIAPU+/uZUuRYYMe4Ql

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2