Extracted

• • Target

    df7cf77e216f1276ee3ef47675d8c305_JaffaCakes118

  • Size

    1.3MB

  • MD5

    df7cf77e216f1276ee3ef47675d8c305

  • SHA1

    026b951561b8c05707106d662f3715d5c70c2a46

  • SHA256

    b3af8f647778681b50742035c998631f9602db0045bdbe1515bc810bc7520aa4

  • SHA512

    00931b9d2ef8d8549bd3a281883cbe28b21e516b06e205941b2eb2609d108d334352191739ceaa6deda4e62e48209b6094ea636b995f87d311c4a0af835cb943

  • SSDEEP

    3072:bY639NCUicES9mvW9KVVkFJB7p8wmuW/fqfeJQJFMuhz4HqqVs1G0GUDLyNhGh65:bIMOH5GEv1iV

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2