Extracted

• • Target

    d91e1cf609070feb2bc9053fdc90e7ff_JaffaCakes118

  • Size

    306KB

  • MD5

    d91e1cf609070feb2bc9053fdc90e7ff

  • SHA1

    f27ab41ad5f12eefb021284c4ab693d796c26a86

  • SHA256

    38ea14e035ae51ad0291d3eab3de38f9dc59471890d64373014fd1994f4ea305

  • SHA512

    246e57cb09ef6019b5aa46d5399cdf7c972943ad9db1c24e892c0704a18d17a4e5e2b0d4d3ccbf36757a8d026a979e4b49f86075fe7c0e845724a994469f0760

  • SSDEEP

    6144:sxG5b1qQ99Mb5UgJfyy4DL5L9kR+iNfAJVs7lT9WJUNEAE3yIpjgmhmX+afXL:s05b1qE9wUgJfgL5L9wyJVCT9+UNY3yl

  Score

  10^/10

  cybergaterrrrrrrrrrrrrrrrrrrrdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2