Extracted

• • Target

    ae3e49ff24940a1fb430919c8f4097dc_JaffaCakes118

  • Size

    484KB

  • MD5

    ae3e49ff24940a1fb430919c8f4097dc

  • SHA1

    deaa2cd8507eb353c358f8de1b98b50e96e43733

  • SHA256

    eb123d3413aab97973aaea9183d3b8657a7b19d3b68b4a6b60f2fce6812da294

  • SHA512

    f16ebdeea955443fdbe0e8303b2d66f0fd9e5131f74aa1ba4924d529afeb8a76bac0ee3ae1acbfe95c12e32e4964581bf890659ffa10a31df73bd3a865dfd743

  • SSDEEP

    12288:ELjxosIS1WmBE09182IgB1GR86D91ba6v9bCi1:XsuQDI9R8Y7b+i1

  Score

  10^/10

  cybergatebotsdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2