Extracted

• • Target

    b160a01e71a00552b6b44a154975eed1_JaffaCakes118

  • Size

    328KB

  • MD5

    b160a01e71a00552b6b44a154975eed1

  • SHA1

    a10ce018c565b3df2d28e3cf232907a601d141d2

  • SHA256

    b55f118360981859537e4ed6bd05314620fa6980470b15174e2f8e6a03d6dd8f

  • SHA512

    2f8c9311f8dad3720dfaf04e39d2e297619cf6d2f8d2556bb861055efbb9222022b5ccf8991237fbd15710d897d97790c8839a479f47e7a02fca1a22205ebf20

  • SSDEEP

    6144:LN32OMeDAB5z+HcIjyV1IRu7o1zjuigV3fR/TmX57+mrrGhpMDqPjKmQz74:LNXzAAcIjyViRfC/mX57+A+pJjJQz74

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2