Extracted

• • Target

    d4509d751cd3bbd43d04cff3e8d584bc_JaffaCakes118

  • Size

    364KB

  • MD5

    d4509d751cd3bbd43d04cff3e8d584bc

  • SHA1

    5759762b876c6115bdba93923325a7f9f0754c45

  • SHA256

    24e46b62f5110b3f3bc19d83d985b552e04d75e5650ecd4ea74a673286e6307b

  • SHA512

    01c67af74f67ac6536da5a70a43db6a0b7da624acb344dcde7ea8dabb940f265e2341ee736f7a60d1f3ba47829130b47e2a8f187550cbc37c6298d205918b3ea

  • SSDEEP

    6144:dkTzB2h4HxnfLQYc2fHZ0Zs5oiiJOTqAITs3NwOOY1Mbkhw:yTz4h4HNf0cH+Zs5o7YTqAITsdw7M2

  Score

  10^/10

  cybergateledudiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2