Extracted

• • Target

    e37877a296dbc464074314c5bf62430c_JaffaCakes118

  • Size

    1.1MB

  • MD5

    e37877a296dbc464074314c5bf62430c

  • SHA1

    6469310c7a4a2c7daaab2b922cc8b5bd5b5ce38a

  • SHA256

    b2e60308339e30bd9197fc74fa313cc9aed9b112df1c1bfde1def3b9abef2bed

  • SHA512

    ec48447ba2a44dff6e3f661f9e97d0de97d5bc72a29e2188618b773db0719801aa48464cc15b07d8f5304a540e51803ce67e75ff2f04889aa19dfcfa6a60dee1

  • SSDEEP

    12288:LJ4w68yOE3iZa/i+Zk/hyWzaileoNhSJINAbifgYi0Lac:XFoqLmbImoZ5

  Score

  10^/10

  cybergateanniediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2