Extracted

• • Target

    dca68e77666ddfd58b37d42f28e95ddd_JaffaCakes118

  • Size

    488KB

  • MD5

    dca68e77666ddfd58b37d42f28e95ddd

  • SHA1

    1c70943ae4c285bdf09c209f129140705302f995

  • SHA256

    ab1a11b37ca2f5e39dd3e2f5a540f956a4608889107bb0a2361ecfb9175c3773

  • SHA512

    f80d1065041bea51853bd46b9e4e835a39e216528cd3e4a3977d209f3528fa312942132f43f4a1ae36080625aa4e77d39eb59ad4e6093a75b95e50fbdea14a74

  • SSDEEP

    12288:Ys6k3pk7ywoIttX+zM8H08iaWU4FLZ412:YsLZk7y9IttuzMqvfmLZ412

  Score

  10^/10

  cybergatess02discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2