Extracted

• • Target

    bfac647bc96a4d136c536454c0fdc856_JaffaCakes118

  • Size

    3.0MB

  • MD5

    bfac647bc96a4d136c536454c0fdc856

  • SHA1

    6cb4e3378112ab5383c7b2fff272401f223b52ac

  • SHA256

    3692bc4c8f73bb5b4e1bc4f681e5ba594532569a5350ab34bc7292c66d04da9f

  • SHA512

    76cd20989bdcec6a4890e1e5c8f051bb7ec59cb2d065e20c8813616d4c1f96a074660b877814c0a982b82166cbd4b50ab84a6c3e718f6c819937c06d54317e90

  • SSDEEP

    49152:IIluoE0pWylgy8DQVs9Z9JkzvqYBBb0RIglO1CuL9VNcaCd9Q0RIglO1CuL9VNcf:I8jEcVEDuyAzrBb6MpCA6MpC9

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2