Extracted

• • Target

    df498808554f74c4d77d3bfc18d980a7_JaffaCakes118

  • Size

    460KB

  • MD5

    df498808554f74c4d77d3bfc18d980a7

  • SHA1

    caa8b8d8d7346ff419a39e11f58f3c349b8efd46

  • SHA256

    909d6f2e7ee5b52099fe9283359ccea79cfb5ad8ece3da27eb94faf5c88e45d4

  • SHA512

    57ff3925b6a471c9abc51c78c6b0410d97730693b35b872e39fe4d9b762f64fd8430849fa802cf5f9379e07b875be295cabd63a93a99e0bf6cebaab073d0d1a3

  • SSDEEP

    12288:AL0LyibHqHeN1EdCMDftwlZigDYc2F+CzO1oRKnJL:rHqHyMDaXDYc2FZi1ucL

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2