Extracted

• • Target

    d90c3626e2d3c1f455192e0368858b1d_JaffaCakes118

  • Size

    327KB

  • MD5

    d90c3626e2d3c1f455192e0368858b1d

  • SHA1

    394b10a25189355832f1c85c9bb1a9808ba32f8a

  • SHA256

    0edb4b9f0bd702a077f5b8cf20cc8e1b5bfc440f7fd000957d44ffabc4fe0f36

  • SHA512

    9c40b004eeeeafdf0ef6191108b9d18309123cd5b8ed613f60b5cd6e07ec1874b136484eedad5747d3327eb7482f00acfa292cf7863ec81c856527440afc17b5

  • SSDEEP

    6144:32s2oikf87oWSJXsmnVJMKLmaEuDyj1Bm5v/ObQeNUaEfF0v370Bwzyx:Gs2Nkf87IJX5VJMKLmaFDf/ObHLv70BS

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2