Extracted

• • Target

    b38d85bf0491b4e3c98fbf4c213574f4_JaffaCakes118

  • Size

    314KB

  • MD5

    b38d85bf0491b4e3c98fbf4c213574f4

  • SHA1

    9ef91cc4704d455385315fd6ed62d9201d6d73ed

  • SHA256

    5fc8329c18b8b69f13fcd4be076ceee6a613b55d8d8d5acffe1f454aaf5396b8

  • SHA512

    98d1c36e92884e7f23cb3a37dfca464a27343b97b6010c0e0ba3e3b3c4aa68cbbe7a8a8267b1514bd1e59d650aff368cc3be0cd58c6101d880476dae4c9f5f63

  • SSDEEP

    6144:tCORw+VT1l1TG2RUcC/6PdhXPOGF85Gf6fAmbDUcvWNzMyGK+sMdNG:t3N1S2RvW6PdhX2C8cifhbD/+p8K+s6G

  Score

  10^/10

  cybergatespy1discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2