Extracted

• • Target

    cb27fbfa9873e35aa304e52d3e64c801_JaffaCakes118

  • Size

    641KB

  • MD5

    cb27fbfa9873e35aa304e52d3e64c801

  • SHA1

    9aaf1b348e047963ea2add24a84ee7396c722ca3

  • SHA256

    95b00a3a9c99677e09480737ea0dcadf242768b2b34a64246889993bfbeebf4d

  • SHA512

    0847b269bf122c5b6920da729bf87c407e27c7b22fbeac9b718215a4b129fd6672d8d9681a7063adfd5f9ac616e1a4b92092344acf41eda0eee4c94cb5fc941b

  • SSDEEP

    12288:g1dlZo5y4/JlASzoe0KZPYDbOq7gNii8kXo/tGN:g1dlZo5DJlASsxKZPYGQi8PO

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2