Extracted

• • Target

    d70df07cc34b89436e021f59a06f0c47_JaffaCakes118

  • Size

    323KB

  • MD5

    d70df07cc34b89436e021f59a06f0c47

  • SHA1

    a433020c429005945885df33b04bab2eb1708165

  • SHA256

    c91075e1b8db35b6342e5de4c73e9ede79a67cad02bfd98fcb7d5c15d17835f3

  • SHA512

    2c35f6636026ec05d18401dc1bf015543e3a055d752df9cfa552577d9f5a29e2d2f305e9cace32db2916d125d330fa8853a9d813430aa6bf7a55269013e02289

  • SSDEEP

    6144:VjUMIJkHIed+jDv+DIp31Bg+NMATcV56qv+Zm3FfGn0GVrJhNMDWMchSS6GzWOM0:6MIioe3MRgSMATcFvb3FfG0GdXzM3PO5

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2