Extracted

• • Target

    ac92d931f69850e99f8804b2f8cf86f1_JaffaCakes118

  • Size

    470KB

  • MD5

    ac92d931f69850e99f8804b2f8cf86f1

  • SHA1

    df5ddb082c6c07d00d372f1ce3138011700d180c

  • SHA256

    e18aecd127f49a4bdb366721b03c6794ac004569dbfcd139dca9c7596916654f

  • SHA512

    5bbae0e836f0729188b9df677be7fd7cffcb2e4c69083c72f987e65ca7fa39ad3f154b6d004f7b33402463641b67eee6f59f024193c2719713874fb618f8ba60

  • SSDEEP

    6144:37Zf5ItcWmV8ream7THSdiDOzHnoj/j4S5ubqWak1Hwnuz7zdLn:37ZRIjlS8diDOzHoLrSqJk12uzlLn

  Score

  10^/10

  cybergatevictimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2