Extracted

• • Target

    bdc8919bc5e2414d3734c290dfe61728_JaffaCakes118

  • Size

    1.1MB

  • MD5

    bdc8919bc5e2414d3734c290dfe61728

  • SHA1

    2561a911bc28559f27a6962b17da391335bef955

  • SHA256

    5d35e893f8d5324c7eb86ee9318203d2a2203c3086894f792e1d75797e240e4c

  • SHA512

    f9f6af1ce61d3968490dacfe7a1d323498addefc1aa387624585b36dbbb9dddb97e9b7c97dd09350c8cfe24ca768bf379d137702245fc5e148860bc48a7eaae5

  • SSDEEP

    24576:6nMwQgsiK3AcIXFFf5uiuKcMSq9if190tifQ9g:6MlR3uh1SM8j0teQ9g

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2