Extracted

• • Target

    afae9e04478a8622a5b2446170cd6500_JaffaCakes118

  • Size

    368KB

  • MD5

    afae9e04478a8622a5b2446170cd6500

  • SHA1

    a306048c77ddec0bd81c3ee7c3fcf07de5631957

  • SHA256

    439daf76b0e43f708350f56f0276b1769e507c3b86a2be93d5e5691a427fb83f

  • SHA512

    04ebebf777ff89a35b71f3f052a2b309a03fd645346a27582b7c83798638e08ab9690780a4a05cff8c0c116f2808dd8bf230929e45390330d9395dc58c3b49c7

  • SSDEEP

    6144:b/lWiadzyGD6/F0cicyPTg2NeCVn4qIf4S9RaW0aKXgCwS1d7ouk8Hi:QF1k7i3sqIQeRPBKRfz7ou2

  Score

  10^/10

  discoverycybergateemrepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2