Extracted

• • Target

    d3379bdf4f9eb3b62d74d906a7a7f999_JaffaCakes118

  • Size

    1.4MB

  • MD5

    d3379bdf4f9eb3b62d74d906a7a7f999

  • SHA1

    e54e06c7b5b318ab5692e2ed62a808f4dc4d8236

  • SHA256

    54a114435b9d427b7f982d09ea9cac52abdd822b40946aad454be86798b71ee8

  • SHA512

    96d7d0d87fe8aadf421653229932259fe339a053451f483b8a57456ac8e45ecc3c1ac57e192014a49bf609accafef037d756b9a3bb03aef6d35177801081a13b

  • SSDEEP

    12288:ROA79UVy/EBFNGXX6fk6AOUZcYYlie07qhzloVYlaPBCvlVPpgwx1QAaj3KupFiV:WdfkKPipwlw2i6890K3

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2