Extracted

• • Target

    d434fb5cdfb1d313942a4ea5df6086f6_JaffaCakes118

  • Size

    306KB

  • MD5

    d434fb5cdfb1d313942a4ea5df6086f6

  • SHA1

    61489a85971868012bfbf790cb58bf44b83c31dc

  • SHA256

    de5ff12910c170164710529c663282c02c76bad969ea41c14b2b1369c4fa8690

  • SHA512

    c603840375845b8a10de2691f41eaa885315c11f7ef6e43f49a631b8b0e6865ea53d40b7a6e6429f1e67da09eadee06ef6fb720bd6880617c1261ea664e30b4c

  • SSDEEP

    6144:RM0uOixYx7a3mD6pR1xPpagjcAIrg+XodbpxQ40muMg:RM0uOix4a3pL1dpxJIrg+YZbG

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2