Extracted

• • Target

    bd47c245183950dd010e22f9e899ff9c_JaffaCakes118

  • Size

    364KB

  • MD5

    bd47c245183950dd010e22f9e899ff9c

  • SHA1

    062df7e0242cf6dcbcf7937f641ae6690efc3a44

  • SHA256

    97d2c32d0677b4f8e45dd14bd25250341c49ba7de7c9c3b1f815e1deb5b5dad4

  • SHA512

    3a9946f7c3b5b7babc7b1258f9d5b892b75d10a43fa8a5edf90920691e8f1599c0ad02ef7507fa75625c984937c49bec1e86bb9134fc467575c83155dbfbb877

  • SSDEEP

    6144:rdBIvNWc4F5I7qW3rdTBgDUBgMJguyh08Aw7icF2vySOD5m7YPn1YDeF/:Wp7qYKDUCMXyhTAPS8SoYPRR

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2