Extracted

• • Target

    d5bd31fbcc6d179b6c8614cc8b239a88_JaffaCakes118

  • Size

    293KB

  • MD5

    d5bd31fbcc6d179b6c8614cc8b239a88

  • SHA1

    b161a972bda98a623027ced6624506ee4defad40

  • SHA256

    363c4443cf0da9fdc8c976d9209a7771614f4dfe20828a1009c41e4ae40e4fcf

  • SHA512

    9e4e1bcbca8b8c1f0185503bb9134aca06b066e97d254a78a45f8528a6f7b43755a0f3d78e6521ad59a43173a3474148b1bb671bb16f048a050fa2d23216a7ad

  • SSDEEP

    6144:9e4T3Vy6LTGR2i8ka1+7evrpgHxpWHJCYyBQoMXh6uAz:o4By6P3i8khOqHPWpLQux6j

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2