Extracted

• • Target

    d0b9ad24b88c20afe9a0a93276f9ce77_JaffaCakes118

  • Size

    1.3MB

  • MD5

    d0b9ad24b88c20afe9a0a93276f9ce77

  • SHA1

    2f4f73a50336b0a861b6d6b932d882c66b6fd251

  • SHA256

    89055bcd90820f45b6aa2cbdb2f382ff96340e5a0d769747a33a6f714543f125

  • SHA512

    6584c80a7f9cd958210e7b34c31f073e0161837ae591f21c5017485a4e8fb6fab4e2f432f04dfc6a0a5f1e152d538a41455856886e20efaaa9f51789202af111

  • SSDEEP

    24576:v2U69Pk9S58iBlVc7ZrjFe9pyhnxuJqc4s3B+6Tsir5DoWHG8YaXag:v2F9Pp2/FapA0Jn+KrR+aV

  Score

  10^/10

  cybergateyeni-discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2