Extracted

• • Target

    d03fca4da489a5254d73c05a87daefa5_JaffaCakes118

  • Size

    294KB

  • MD5

    d03fca4da489a5254d73c05a87daefa5

  • SHA1

    acc9984e1e8544966bf3703717781c5eb286f23e

  • SHA256

    e7e91b96152faa1d08c037da177b7a45d3423688db2c6f30a74d4d473ae1d54c

  • SHA512

    4ed24fe8296c280b427d346a2d110c5c7747c7f230e1cc110bd4eb41aba5ba76fd7d3128f3f012c009c87d0d3332c0b4585cafbf91cd2de6ee463bda1c48b4d9

  • SSDEEP

    6144:y4XjZEMfH0MYXhrynDPIP9GlmBcPxunGw7MgyZdi3QTFaTy//V:y4XFEuUMYxrSDPI1ymBoYYgyPi3s7

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2