Extracted

• • Target

    db6227cfddf8f28f95475c39a0bfefb9_JaffaCakes118

  • Size

    321KB

  • MD5

    db6227cfddf8f28f95475c39a0bfefb9

  • SHA1

    b12effd095b56f1f3aaf01dbcc3b0bc849ad9604

  • SHA256

    b13aba091b0cfd707fab3fe824b3ca33c504de1d7fc4f8048048bd1267da41f9

  • SHA512

    3cb862628170108b23e45fdc9c1379a2431bbb1fbe270ed1741606d63e9e248ca1ebad84657ed27894a0386c32bbf88150f24be7fe3f8e5d9aefd479174c94e3

  • SSDEEP

    6144:/3iuLKzmuSWtA6f3BturxyrI33TGcK3BGNbHODMqpzR7y5ABh:5KzmuSgA6/Bklyfqb2Mqp97yW

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2