Extracted

• • Target

    c62c3ab4365414741a11c2dcf8b50c90_JaffaCakes118

  • Size

    920KB

  • MD5

    c62c3ab4365414741a11c2dcf8b50c90

  • SHA1

    bceb1a0aa166187c0227b069f1e96def06b7e67d

  • SHA256

    f40342d1f151533403e90e6cdd0d5acfc61a42569213d053f51d9bc68e8189e9

  • SHA512

    3761a6c5c2c723d56652c943b912a4ad46308302c472a4822fd00e7bd48835f07210d2b6a6fdc37f793cee6a687057023b42825d3b232e59956422ec299f139b

  • SSDEEP

    24576:5YBEiX+7V5fSFGlVzeWQAuO0tvhDNpOA+:OBEiO7SYX0vdNpOl

  Score

  10^/10

  cybergatekeklerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2