Extracted

• • Target

    d3aeb8a0f08df19d88674208a99a1d2e_JaffaCakes118

  • Size

    367KB

  • MD5

    d3aeb8a0f08df19d88674208a99a1d2e

  • SHA1

    84da384c8f5411b93b625f201241eb04df1d6844

  • SHA256

    47097a096e33cd51daae94f8cb04366e2e11f694d9f785a046cba9deb4349425

  • SHA512

    ded6f784f0de602102c5e72c9ef21845ee3d8950f6cfb902dc6d47109fd8575cfd555d0ac58fd2fb5f72d41581caed328b8afc8ebb0ac94c7a8d4ee47ab7f1d0

  • SSDEEP

    6144:gd5h/5eIR/s7QIujAb26kU9nwbF9gvIETIfOMiNANdSNuUg/mgjeCrHXM038DD55:grhBeyVFFpbF9gvFOiyNYNuJ/BKCrHXQ

  Score

  10^/10

  cybergatesurferdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2