Extracted

• • Target

    beff6858b83f36c20c3ac8f41dd847ca_JaffaCakes118

  • Size

    276KB

  • MD5

    beff6858b83f36c20c3ac8f41dd847ca

  • SHA1

    5cc449143512ccda3d5cb9b3c015852d504d4b4f

  • SHA256

    ac0fe445073e6c12f168113e179368d27a0e5e8c63e6fde55a1c4ed374a7875d

  • SHA512

    412ad05dbd88b092156d44fd202807a2d797a03695b0b588d646d7a4094378778e4f3dde2063d3c6f17b43da83e75a37fe38606ad4d54c9cfc721de5bd6d5b04

  • SSDEEP

    6144:DUAJb4uOiL7ZGhs5XMbLkJ3Ocj252S5LJoRz:DUOb4uOq7UhsmO3HyQkJoRz

  Score

  10^/10

  cybergatebotdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2