Extracted

• • Target

    ae13f9b60fe711288abb86e2f3f72f82_JaffaCakes118

  • Size

    2.1MB

  • MD5

    ae13f9b60fe711288abb86e2f3f72f82

  • SHA1

    4849484516ffed02058b8988849489631fe0e62a

  • SHA256

    49a368fb7bc1054adcc105863a4d9d0374605328e9c2b3ee2be71623d52f96bd

  • SHA512

    4f80d9160a5a932f17656170209a315441f89f69b2ba221f4bac04811180ae221818254fbc343c0f2bc06eecca1289305181944499eba70edea91a81c7a36316

  • SSDEEP

    49152:ngNmKHbbgL81LJi96/BLzmeS1Hu8NYIwMM+w1eN4:gIKHbsW9I6/Vzi1HdXwMIQ2

  Score

  10^/10

  discoverycybergatebindovanpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2