Extracted

• • Target

    dc150c773efbb2529a6b2a962dd70933_JaffaCakes118

  • Size

    21.0MB

  • MD5

    dc150c773efbb2529a6b2a962dd70933

  • SHA1

    7f3e044ea79644e2338ab52ec68ec10f950d68a0

  • SHA256

    f773e99a3e9a2501ce6b55b733c3ca8b589ac69f90d87d1a2d2aab8dbed322c8

  • SHA512

    b89fe4c4760b7f3662eaa3155ce6a74c23185f19635521359432d56c283dde94daf112734c85fdb698943bacd42e0f07ebcce49f54dedb24792c82db7ba2aaac

  • SSDEEP

    12288:Xb3yOcNCL7XgUjqDk3tcvR4rnbIqQsghxWxD4kDEVr2usmNqui:+vCvg0KbQn0/cD45Vr2usT

  Score

  10^/10

  cybergatetestdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2