Extracted

• • Target

    b61d7dbae85ed4b5a5107df524c48f27_JaffaCakes118

  • Size

    400KB

  • MD5

    b61d7dbae85ed4b5a5107df524c48f27

  • SHA1

    feaa5ed50aa97195387dcb86f2f798b1c24ec21b

  • SHA256

    0ebc5e8d13e049eedc9fee8c8506e0ee242986e7f07fc48393eef28d8dbf295a

  • SHA512

    10d7579ced0c497e37d9f3fcedc36e2cca41ed8bec0c526f126d8f94c4316aee4f5dee0fb9f5a84c83ffdee621a7b36ed5bfbc6681d74a2f15007c84f9b6d2e3

  • SSDEEP

    6144:AbXE9OiTGfhEClq9f58Tyed2T+J81PxUMY8khGgcZDIdoAy8AeK5sxoBb8HyWYlG:kU9Xiui+STySa+2PW8dg7D/c3BcwlkT

  Score

  10^/10

  cybergatesnserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2