Extracted

• • Target

    bc8ddccd0f3ec51e6cf4884ca4a19c26_JaffaCakes118

  • Size

    831KB

  • MD5

    bc8ddccd0f3ec51e6cf4884ca4a19c26

  • SHA1

    175f16c3fd86e1ae2026c252f72d95890dd6ff3b

  • SHA256

    06bbbb91d9783faa28626d35c75139fdd68f729e7d6f4e03ede90425d0219359

  • SHA512

    405dc927f65881e579b97bf3c31d9ff7d5b5069ebdfe4570de93b8591f99b8153ce918491dfbe66ad75b936cc832018a50266d8ae300b43a9b86428c99e3c9eb

  • SSDEEP

    12288:AJFt+zwK+GQG8i760jAFmLVyf8yR1EifMu30d+7qGk2sIcraF:A3K+GQG8i7RimLVdyzEKdqZ2CaF

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2