Extracted

• • Target

    b1ab37cd1f43237ffe2a750bd4feef45_JaffaCakes118

  • Size

    1.7MB

  • MD5

    b1ab37cd1f43237ffe2a750bd4feef45

  • SHA1

    bb19e4bbba68606fc5eba8a00e5c93495dd8ec4f

  • SHA256

    cab80174573c123e7ece3df3757a4dbaa8a9064247763e8356f4de30748ffe8f

  • SHA512

    ca23f2384acaf6969f45be441b06b902a1eab19bda1c9deae07d5739541a6a36bcfb8b2914738de103669f8b3fb8e10bbb8558eba73cc965da23c06ddb18b27b

  • SSDEEP

    24576:RX6P5tSwVSp18i3d+Pi9rUPOJX6P5tSwVSp18i3d+Pi9rUPOXwJ+l4vG1mmejfDS:IzuOPxzuOPiwJ+l4vG1mmejfg52XjW

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2