Extracted

• • Target

    cf69d7ed9240774bc20487c0b54ae9ac_JaffaCakes118

  • Size

    493KB

  • MD5

    cf69d7ed9240774bc20487c0b54ae9ac

  • SHA1

    3eb61bc926f3a834a2646f336ab71b8ff688a1ca

  • SHA256

    b3533d573f90c57e7305b01931f88cda4ee1f5f108e1aa29763212f846549e14

  • SHA512

    86b1f8c8c0d1ef6540ace9741abeb9110cabf788110d4ece1602fa1b82c924f70e85b616546e00043cc48ea9cdcd834cc99e045eb38b6ddaa92f82a398f44bee

  • SSDEEP

    6144:636v30SIoktTuU9Vl4jBbdbIwANSGE3RNHgmFUNVDjzHYS4P9Z9IUcM:rsSIgSl4j0wAo3RNHgmFuDjEV2UcM

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2