Extracted

• • Target

    df85f425c769f2016cd2500fdb17bfe2_JaffaCakes118

  • Size

    454KB

  • MD5

    df85f425c769f2016cd2500fdb17bfe2

  • SHA1

    b6128c8f5da5f5d78b4aee0b2920fabffd0d6e8f

  • SHA256

    29103aa44496d47524e99b397f27427bf99f530e9423654c9e9e1c945aa881cc

  • SHA512

    b44ac4a8648a1b4392b1060e0e1abc2a88d9419f1caf1865f4d950b4cfe089f67388739f896f08bdd20e12be7ef8c4b9831f45fed995be1c0cfe6694b2ea0d34

  • SSDEEP

    12288:Vdno3Z9Kn99oUM6Dv4FYvR6XZnGgcm4zDrxp:MjKn99of6DvmcR6XMg3qDlp

  Score

  10^/10

  cybergateimbecildiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2