Extracted

• • Target

    d0c1a9fff5cbc78bc3c4702f9837ffc3_JaffaCakes118

  • Size

    555KB

  • MD5

    d0c1a9fff5cbc78bc3c4702f9837ffc3

  • SHA1

    7a44d26cfe6b0ce2452a3de4b9b2b701d9ba1c9d

  • SHA256

    364ffeb3b60b22d3c70f1aa281737d4a99bef2e5e12e3b7ac48a915795de5c43

  • SHA512

    6eb59f152b15c32aeb5a109c84b3e545051af1067e07ced9650949184c35d3a502893fdfe078e6a5b404024879f1c3e86d274cebafd18e7161cfc31e8512a9d5

  • SSDEEP

    12288:GjZ2qVMR2CowFaib9Gy+Td7D+quTKQJikrO3RRtLUWoTVluRCirw:e7saOGFm9fQLCR

  Score

  10^/10

  cybergatemoneyriderzdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2