Extracted

• • Target

    c06bb886903ab7bfde7543a5a289f8ea_JaffaCakes118

  • Size

    1.0MB

  • MD5

    c06bb886903ab7bfde7543a5a289f8ea

  • SHA1

    7b332b47ff64adc36949e1d2ff0e6f88d9882df2

  • SHA256

    ed95bceccbd260e36d6d1141f2156417116d016f3017bda32485104e6db102a4

  • SHA512

    cb6bc86dfe5f7914c064481db824b9e1af490c8665844b4294ab0ad5baba030003047060918794f7141af00ca072ce22f0548067f338b14b83db312197d4d9cd

  • SSDEEP

    12288:aqPHvPVbMJnYP2quL2ZpCr5g9lZk/H7c5aHhjRSJ:9XtYJn+Vc2/Clg9lo7CaBjU

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2