Extracted

• • Target

    e09841de0fb25c6bf6bdea8af30c821d_JaffaCakes118

  • Size

    405KB

  • MD5

    e09841de0fb25c6bf6bdea8af30c821d

  • SHA1

    880ecee64b0e5f1505c9a818e488dcf6b62bf7c2

  • SHA256

    eb40c31e8dfd699ead4cc95d487f67a281862e142e5810aec790b2713949d471

  • SHA512

    ffd064d3aca17b679fff4217585cd243891a16cf3467f25e9181896919ef25adc14d64bb6fdcb17872d7ad3e0d5bed5cd0f2f58b7be9d66b2f1fa33cb5c79f05

  • SSDEEP

    12288:cnUd2HUUjD4iK62/iq/k9D+JzPatxGcv8sXV17nOckUK3Rujw3mCYa:cn0UAiG/iq/kKzgGcv8sKt8jw3nY

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2