Extracted

• • Target

    da540b4e6ce385627155c92c1c828e98_JaffaCakes118

  • Size

    460KB

  • MD5

    da540b4e6ce385627155c92c1c828e98

  • SHA1

    efe543380856bb20aee3023d97629d3306d1677c

  • SHA256

    3d4dd9d615bc273dc7ac7589898c062d41d02257ef071f9403f067651c44c177

  • SHA512

    5dee2e5f39f1262ce871a6fd6d4d61189956f330f2f28e892ef4b1c325ddefbce0891655b52d00d0e5949e5c371335423d629d0bc34206e782cbaaeeecc1276c

  • SSDEEP

    6144:BKI5z/6bbh7Cx6v7PVh95I+NRjd75E2j8Yw1l7e3983TI0ht6xd2V/EzzPSwqFUG:YI5Cbbh77jTXm2QvTJhQxUV/0pqi6rt

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2