Extracted

• • Target

    cf2de7e90c5ed49abb65b66fe0380ecb_JaffaCakes118

  • Size

    460KB

  • MD5

    cf2de7e90c5ed49abb65b66fe0380ecb

  • SHA1

    9e2dd0839ea2b95bc3ed45e049cad12e1306ee3d

  • SHA256

    7c31f4a664fdfad322948c763438b67933537f3f14d2ebeb8c664eda20fbfca4

  • SHA512

    5803e92d78ca9f75b34364b4eaae2a86ac0a3056e1e235ec80dab10dc8ed6321d1505b7aa2786f248d61675f3b448d7293f9d370d4252cfd7f45fbd0881b7aaa

  • SSDEEP

    12288:QvVyk29zgtc1M4FFnV4D+PmAmhp40phE:QvVF26yXnSDX5u

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2