Extracted

• • Target

    dc27fc65e313c0959ba77efe15371909_JaffaCakes118

  • Size

    574KB

  • MD5

    dc27fc65e313c0959ba77efe15371909

  • SHA1

    feae08b7fc39cc6f6314cfb673f350e2a2d1af7f

  • SHA256

    8274a6c738d34a554d9a65a643bd5d4a43064fe52634f2a62d3e7395927d5f71

  • SHA512

    a6f9c5d054acc561c282f39a176c526eda4de9dc04109a40e059337848e2215184f3002537d638aaf20a99da68f56ebf5b179904c6bb32aa23218f1e2efc12ec

  • SSDEEP

    12288:AW+1oQIGQBcPGN9FuP3GPjio/5/4Loq0e9iSnUHg36eDTCM+UPZoS:AW+1oPGdO3FuP3GPjv/1Oj0SUHgxnCMD

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2