Extracted

• • Target

    db8d957b11131ebf6dc263e248b3d3b4_JaffaCakes118

  • Size

    912KB

  • MD5

    db8d957b11131ebf6dc263e248b3d3b4

  • SHA1

    a800b5fb44a6509a90d0b90a322421a31aab995a

  • SHA256

    1e59bd2b7a9b15ff9c7df28e30906fb90a4e8932e6a6083426234cd19496ff10

  • SHA512

    6586e17deff892ff1615aa528ef9cf461c5afde1782d24b22d132f60aba399c9caa557d13c39acafd1686670b4ec2fe01f647ef11d90d8d04f16f405a2f4da9d

  • SSDEEP

    12288:T6M2sdII0jqCFGUu9GD0hKI+CjfARNNDSRIZF3mGmv4yTWhmNarjCu:T6M2pIvCYJGeKejfAR8IZF3mwyT5avC

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2