Extracted

• • Target

    b9f490ad889110066f0649cc0cf4cb5b_JaffaCakes118

  • Size

    538KB

  • MD5

    b9f490ad889110066f0649cc0cf4cb5b

  • SHA1

    1a330c4800f40197a34229eb28f9cca942890f30

  • SHA256

    c5d8089d59be3337eeeeb3ac12b12240cae7c86ae4d2800b8381005e248aae8c

  • SHA512

    5c4540309941b1c9de5c8e11e192982068b66129fd4892646ee8e6430708e6cf3a1dc7f70827a3c2f8828f361e849d056e048958a730a3a23d42a8437ea0fc1e

  • SSDEEP

    12288:tHLUMuiv9RgfSjAzRtyfsGcVk7ltkLzmJPbMhyLcnac+:VtARnlVRzm5MAYnJ+

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2