Extracted

• • Target

    dca43d2940a760772908ad70ed66ef61_JaffaCakes118

  • Size

    376KB

  • MD5

    dca43d2940a760772908ad70ed66ef61

  • SHA1

    be92143ba2ed05fdaf06d2d565999ceff62e4794

  • SHA256

    256abe18ef19c969953e091c5dcb6fdb57fd802534a24d235ed6ab1e4aeb9d83

  • SHA512

    8b8b1b20b68efe10c477682897539ad84a7b7f2f745df1423b7302c250553dc08e8581cd90ca715192e751710801b8ad8bf0aaaf6117fd41f489453620b09213

  • SSDEEP

    6144:kdswtcv7vsRC9d2CZIGet7zQg2jxDmiLWVZD2JbOf5E9Vy+gZrWyaYaKyar:kK6iWGdNIGgvQF9miLWVZCVc5E9VoWhO

  Score

  10^/10

  cybergatenuevo gronediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2