Extracted

• • Target

    d7ad8f9568ae217c7e75eeba6e078601_JaffaCakes118

  • Size

    820KB

  • MD5

    d7ad8f9568ae217c7e75eeba6e078601

  • SHA1

    19b2e4e6b36f4abc59a94cb572c2376992dcf47f

  • SHA256

    1d4b52697b4f5fbaa29048ec9790f7103d2d05431201ee4f7729712f6678ddd2

  • SHA512

    407e47ed07eb3554af074975e12ea7930d86a873235e7fab476a0a6d446ac9bd2824a25174b7dc28c69e9b6980a0322540cb0fc91c5de3c46771a029b1aa7795

  • SSDEEP

    12288:sNE8lLM2TMetxE4iZVPozYyhBJoqIZ4iTp0702bLD1cl25JtUu/qBiN9:sqqFtxVcVPoEmUZ4iT+VbH1+eJtUu

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2