Extracted

• • Target

    e0f4b37e3bc7964248643565b814ee13_JaffaCakes118

  • Size

    332KB

  • MD5

    e0f4b37e3bc7964248643565b814ee13

  • SHA1

    96c6d70e33bb632a7a43cb7122a782979af38fd8

  • SHA256

    f2559207cd1abd2ebc5958601251c317029faa054d7dabdf4d441592bb033ef5

  • SHA512

    ca0bb8e9fb007401506e5289ac1d07207b4a2c6fc6c2460d59cb6653eb350bdf38c00576034978ac552e9a047cbd590cb6fe4b64e619d48e9b222044a259398b

  • SSDEEP

    6144:spJVK1rCszyuCvTmNncBypWy3bMQMAmf/ZAdJNpNjGOnOROWYey1Kva:lVCs2u2Tan/E52yZAdn7OROWYevy

  Score

  10^/10

  cybergatehackeddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2