Extracted

• • Target

    b291a6dfbb99c405f1f7a9247912ac81_JaffaCakes118

  • Size

    513KB

  • MD5

    b291a6dfbb99c405f1f7a9247912ac81

  • SHA1

    1391e2b7824c86a851b2f8adb57f71640d445e38

  • SHA256

    99ba8b0b6cc249b8d6ba95a5ba2762ad4177f458bf54b8145ebbac414f25aebe

  • SHA512

    7dfa71fbbfcb96ceb8eb45c9e67544be34f96dc6382107e75aeed70ec9065dc9099a2a94f2bb2da05d6affd083f48a2d6a604d8cf6a347a546e6bcb00d620dc4

  • SSDEEP

    12288:I4VU7ThvLpMtwoevLP60oaTKM7dVjAfehakJc8g:VU7TRLFLSzaTKidVMmhaktg

  Score

  10^/10

  cybergatelightdiscoverypersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2