Extracted

• • Target

    ad049c103f9e3c4a5faf75c49f358408_JaffaCakes118

  • Size

    932KB

  • MD5

    ad049c103f9e3c4a5faf75c49f358408

  • SHA1

    71a68be6ca0e39217fc23cdc9f3afc93e6b83502

  • SHA256

    7f6757273501ef2bcd005fdb401ae379be3ebd3cf8487dc8c86026c3d9d80bbd

  • SHA512

    27549f482ea109351f73dfa8cc9b7478590b25adc303d4ab3a46dc3b647cc03bd584413123b596abb17de7d7ced1817a0a5f2088461954f09b47cdeb4280cccf

  • SSDEEP

    24576:+CPGxayqXVg4jNc4ptpH5JwtDe0PTq/7d1A9FAOs1:3Gx+XVgiNdpH5KtBPTWjp

  Score

  10^/10

  cybergateíàø ìàðèóïîëü_äûìíûédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2