Extracted

• • Target

    a97bec49799a82830c104cf1052dd3f7_JaffaCakes118

  • Size

    647KB

  • MD5

    a97bec49799a82830c104cf1052dd3f7

  • SHA1

    06f7ce72506b704422b84c391fcc052551e50929

  • SHA256

    c44e1b0559938dc9506c643d5b17760576d1039b2f824b25ce38b27aeed1542d

  • SHA512

    727d4f79f4015070e6552a6fe2f265f169f4d1ee4e3b859f3e1e50c68bbae781d1ad1bc46b5273a72d7cac04ee20126d63e053d2bdcff8330d02e2d75700a058

  • SSDEEP

    12288:6uCMOepzvgBMXQ2dCOEaSGKRNxX7XL7n:6uCSFvgmXQdOSRNxX7Xvn

  Score

  10^/10

  cybergatekaizuma's r.a.tdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2