Extracted

• • Target

    aa85b7e0b136f23381b4440476f8c4fc_JaffaCakes118

  • Size

    360KB

  • MD5

    aa85b7e0b136f23381b4440476f8c4fc

  • SHA1

    ff84fd43067906fe25e2f01712a11bb53544f967

  • SHA256

    dbc6cdc608e23cf306b8f4f71b602b3bbbefcdd6535f85a3d501ae65a67eb1c3

  • SHA512

    ff698c23f5c2b7c172ec7afa189daedb06b1df8c15b1fe7c2de0e274e070d8e9e0a9a5e383b5d6e661bbfccd57a5cfaf94be32041b000506786089b34daa7748

  • SSDEEP

    6144:eQgL+IdMOsnQALavtP09OtZ7uSe6qMtLT3Hb91X/dk4NNKJD87uHKi:4L+eMOsQ2UtP09ObuSBPHn/dk+oJSC

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2