Extracted

• • Target

    ae20a0615e9a055ba208fa61e03e7def_JaffaCakes118

  • Size

    284KB

  • MD5

    ae20a0615e9a055ba208fa61e03e7def

  • SHA1

    41cd640b2b64ed0a0310c5fe65e83fc51eb06d18

  • SHA256

    183c3a76d0f7a0d881ed4cd4f6d6b00bafab627e976e7e16faba206d9f63be68

  • SHA512

    78b1230f9900454cfd6a50e575c9802826e3bdde0265fbc6cec2fd4232346bffb643651a5051772b35c6d706485f6e5e52d1966eb5b772858efb5a3285086b81

  • SSDEEP

    6144:MrxlvVXsdVCJtlEkz5S8jihdJqvGrbHXA4fQcpxo2PIUXxRLWL:MNBVXgVCJPdRihdJ8WTdfoEDxRSL

  Score

  10^/10

  cybergatekustomdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2