Extracted

• • Target

    c51b5426c708a6c7d102bfd5976f2dc2_JaffaCakes118

  • Size

    332KB

  • MD5

    c51b5426c708a6c7d102bfd5976f2dc2

  • SHA1

    515d4022f20696cfec8eec521bb6f8136f46fa24

  • SHA256

    d90b4a4ade207ebf768af252cf8d9b032158122670c50eb6bfafeec74d695f58

  • SHA512

    9d33ad898339f613f4333075eb025c077916ef35cb750d1c94f5195d767f214e8d1a88c73a51a02b034629b5db168139da2ad52c250b5b8ccb676e3f14cec593

  • SSDEEP

    6144:O+hlMBFbeo/NdWb3/JKiWuZTYkUt317/WJ+NzcMvKQNC/HQE0CH3AqQ:jsk+WT/JlRYkUxtukNzcMvKQoPQzCHa

  Score

  10^/10

  cybergatevictimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2