Extracted

• • Target

    da2833abea99f0f14fc3848bd8fe6368_JaffaCakes118

  • Size

    341KB

  • MD5

    da2833abea99f0f14fc3848bd8fe6368

  • SHA1

    bea2e9f7a2ac476a5d1512c56a0238094c5bfc73

  • SHA256

    e4c18dfffac7aa3ceef4a1da3ba4fb1ac3fb019899b5d27c815640f8412cc6a6

  • SHA512

    73dfd641faed2603f9a7dae0faf7803146c9f6847a9c02a516c49f7a9fd479e7020339e851b3fa901f6c8c8f55cdca6e4821fc0a0d6efc114aaca3fd77e29f9e

  • SSDEEP

    6144:x3dUVELbPSoOGsBZJwJUIDMrVM9aITAitWQI+dE1inngTZXI4:jLmBZuGIDSM9xciUQBngTZn

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2