Extracted

• • Target

    cf4f354b5298c91cb9a9470c955cebf0_JaffaCakes118

  • Size

    690KB

  • MD5

    cf4f354b5298c91cb9a9470c955cebf0

  • SHA1

    3c8d10652817debfce92d783b367579b1f56523c

  • SHA256

    ec46c7750feba7159db58cb5fe92fb0a8bcf3dce2731bdeb924588a3ce8cf44b

  • SHA512

    3d59081314c3535488589656760ee476002953687b656383eb21c30e2073eeae6af0435ff215e4eeed568c4e5da879c89af235a3737aa9291b539eebed7cb0df

  • SSDEEP

    12288:3czJJhqrVPlyfsOQaoBOgKL9EwqHpYs6RbkuXoXfirZxrOKh5jMHjcAMf:3czJKVd+sOjoBOgi9EwepYsYXoXK1VhR

  Score

  10^/10

  discoverypersistencecybergateremotestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2