Extracted

• • Target

    bd7635b3c1769b36796cdd0d2ff4a1e8_JaffaCakes118

  • Size

    507KB

  • MD5

    bd7635b3c1769b36796cdd0d2ff4a1e8

  • SHA1

    1119879f8df36ac787e5982ce89ae56ad23cc005

  • SHA256

    e2051f363aafd314efe7a08da0f614c889ba637eb75c4880f405a1ef0f82d349

  • SHA512

    a9bec355b6f34a1f389a0203d717617fe95258d7952c7d0cfea4f53d217c62423dda1ec65e62a015284851ffb0846a969d48bc6fe88a8497ff26c6f53ee6c2f9

  • SSDEEP

    12288:3KT08q/yKT08qE8npXlzGlhP1SZyFwsv7UAAu3C:3KwJ/yKwJEERGXtIAAu3C

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2