Extracted

• • Target

    d295af045c01c92257b4070db5c25d46_JaffaCakes118

  • Size

    479KB

  • MD5

    d295af045c01c92257b4070db5c25d46

  • SHA1

    bc88696d7d94b8c18f64b17b2a4041e89034591d

  • SHA256

    1ed084d488af884f46e5340bbf0cae41a251466a236cdd230e4a206f4b7fe489

  • SHA512

    76f705c8f577d05844b70745db9804595342a5608e4f2efab75177aefb1921bdfbb78107bcd4e0b7752b40b11b1da701be4d2f1314de2fe1744380ed8130bc13

  • SSDEEP

    6144:ihGxjR0EdatlbulIY24kz3n6DJiM/oh+3AadFaGukNawKv5h9HV5/4HQeR7t1KG+:iKjR0gattLguaHbIkQ1hJ/E3Rx+EZ56H

  Score

  10^/10

  cybergatenew schooldiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2