Extracted

• • Target

    b455e4350f399eff197e5503501d5d63_JaffaCakes118

  • Size

    654KB

  • MD5

    b455e4350f399eff197e5503501d5d63

  • SHA1

    b1f7a7876fa3125a840951c683adb5b143480391

  • SHA256

    bf7231888b6d8c1929de0d98dd2499ed0107ff7681f7e6c0e5a746b8ca1b24a2

  • SHA512

    a8e7022eb738eabd83a1a7f223263fdcc4cbb4d3efad1c233d77fe42c4f73e752f512797b728d4f2723b0bac9bb669ce0857decd8c7fe0fc84f66402e6d123ac

  • SSDEEP

    12288:qShCrkTkdxrd4YgO/XhoING+zT2WflTTj/XYZrtoBfDrD2:qShukIbr+YRXG+zxfNrs/

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2