Extracted

• • Target

    b6f5415ff4cf78c6fabb2425d73303e7_JaffaCakes118

  • Size

    337KB

  • MD5

    b6f5415ff4cf78c6fabb2425d73303e7

  • SHA1

    d46d864836f51c74164ed7b7bec155d157011662

  • SHA256

    fcb7351c4b11a66dfded40d853e0ece1a5d2ed738f8e1eeb62a6f090b27c802d

  • SHA512

    07fbdee1f11f2439c7c762387c9b8f81696b003935bf72adccf066cbc6aec88ff77fc7175db1d3143e48492bf6938ac98c4a9f7d1afdd8f58d33fc8e374c17dd

  • SSDEEP

    6144:/xL3BJKadd0hK6Js8He/QRkpyOyzv0bQcI7STHexnYrwDbzUVsj:ZrBdv6Js8He21zvwIWCFYCJ

  Score

  10^/10

  cybergateledudiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2