Extracted

• • Target

    ad6a2462d28cc5a630da6f6d6647c09a_JaffaCakes118

  • Size

    480KB

  • MD5

    ad6a2462d28cc5a630da6f6d6647c09a

  • SHA1

    e77626c466b1b0d26a1943b2813e677c02ad662e

  • SHA256

    bae8d87fed95956bf203b41e11e067daefbd4739d7782129e5ec87462e726c4f

  • SHA512

    8263b4adc2d530e7d982ccffb732de753c5a705e578b6b4899be920732ea48f0289d799ffc26d5aaa1775d4155739d81563a82c866ba1312adff87ef1f468c99

  • SSDEEP

    12288:ViSC/HRxEzUjyfTEfrC1LZRelcl3wFIak:FAyferC1LTXz

  Score

  10^/10

  cybergatev2 testdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2