Extracted

• • Target

    b340c8b3ee5cce48a44114e00cffa41a_JaffaCakes118

  • Size

    1.1MB

  • MD5

    b340c8b3ee5cce48a44114e00cffa41a

  • SHA1

    f20f7e38c049e844c5a5c10bc084f87f2bc29f43

  • SHA256

    cf254d9c84fd8e5adfb5418ec89f68dfbd0465a4810911d15595120358c63fed

  • SHA512

    19676c3bafabe1d5ef79870e2a8f5ab60583b8a51b814730d97c81c77d866f18cc76a58bcf1e1ae62dd2917204fc7797a72d195fa250ae34865f3a0d4068cf1e

  • SSDEEP

    24576:0+lsyPqJDh6soYWclmpYTHBYmFfQfc9E/dnhNgigYH:0+lsyPqJDh6soYWGm2uh

  Score

  10^/10

  cybergate!! cybergate slave !!discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2