Extracted

• • Target

    c416f6cf084f48225a4bf6dcf6b02377_JaffaCakes118

  • Size

    411KB

  • MD5

    c416f6cf084f48225a4bf6dcf6b02377

  • SHA1

    6653d7334e3a56eea5c02493541bf849babe7047

  • SHA256

    366a4a98ac521369c7341679d28f27134176f2a5b7b0e9c3630748078df6fa2c

  • SHA512

    4584376ee1f607d6c01099f4691a7ad51cb804ec88778f58881199fe075514867690e3771600d4fbc3043b1c16dbad2eb096531c634ded0c78fdd753e1d84c8b

  • SSDEEP

    6144:VeUOP2SiabXJPLqjpHuPL+GkjJVzrZtDLUnLAhf3ccwvLJge8X7I5ivFsZgRCVxi:VHOOopWjFs2zrLUnBcUJgtX7I5ie8QA

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2