Extracted

• • Target

    d3e224728eb5af247bd6712ef6989681_JaffaCakes118

  • Size

    903KB

  • MD5

    d3e224728eb5af247bd6712ef6989681

  • SHA1

    c472547d5466d9f5a597e2b54fc3947c2ccc8a51

  • SHA256

    803db359149c66e2403f583d0e8b2ae89b35790a4c075077abed23f198464b24

  • SHA512

    bde330eab07b358d7f976267443e9ccaf6d381a71c66b0bb534ac18257f7bec67c6ae79641726d77b6339681f9a5db561779131dfc80dcfb6ca0b991e8c1e0e6

  • SSDEEP

    12288:z8x1uFkS1Hk48xBX0DGQszHzLZacBQUpI5WxYMjjGVw8t8R0CvyvioO4MZf7oD3+:z8LcZuBgorXZh5wVwS0LszT

  Score

  10^/10

  cybergateseediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2