Extracted

• • Target

    b5dc443c0547761a82d42412ff70ff61_JaffaCakes118

  • Size

    767KB

  • MD5

    b5dc443c0547761a82d42412ff70ff61

  • SHA1

    4b88c28ec1ff8fc667f9e0935bf45ad24e1acaf0

  • SHA256

    0772a122f37b275f0dab83727022aab5c38b991ea30366bce51505787ef44684

  • SHA512

    9cf926b530fb520c60bb5c3d24743ca114786a4fc08cb79326341beab204fc4bdb5ffbcbea413a24ea515658c131e4d1b27c9a3a8a315efe6ccec2096e4e5e33

  • SSDEEP

    12288:zIOrTOrEOrfOQ6zNOOoBLJAKb8mVeM3LhSHxiYLoCmei6U43fHIuUAAy9mR+C:UATAEAfJ6IBAi8mNbhAYWoCmei6UQHI7

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2