Extracted

• • Target

    d1adf68e69fc7c4454cd307d22d45881_JaffaCakes118

  • Size

    316KB

  • MD5

    d1adf68e69fc7c4454cd307d22d45881

  • SHA1

    8f136a1c7a4dd6514c8029162f7453f0dfbba1c9

  • SHA256

    e2ccddefb091d895a61cda453b8eef4aef2518bccc6f48e27280b492aae2ac9f

  • SHA512

    3143b1861e196f6f2bc34977aef0eb141d2cbc0f4983328b34fac4ee6498e0eace54f9347fd60897627c65d9bd55cdb8d35d08e92be9e63e7afdcf3a94d28749

  • SSDEEP

    6144:+g4llx38FpxyCWXfapiQwZEXdlc4GNr+a//pRdtheVB4EY1+P:+l138DWXoibyXdrG+a5RdbE4E4+P

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2