Extracted

• • Target

    e11b0ac96b78feb4474c72454f9d01c8_JaffaCakes118

  • Size

    314KB

  • MD5

    e11b0ac96b78feb4474c72454f9d01c8

  • SHA1

    131d09deb4012ad6081c988d4a705d1200ceff0f

  • SHA256

    06391b424a01baa44f5d8ac312d264ca65de7b34d5ceaafffd471cc8fdb78a01

  • SHA512

    baa525e9ecab8e4391b1d2b62b3c9b5ee0f2683415592c4dc4ff3bd9bf8ed0adb663bb21665a3649cf42e79abbb23e15ce602b200e800aaecb96aff3bceaefbc

  • SSDEEP

    6144:MoJouJ12Z+CsbCdwTxGBoySfDVPrCU4wX/vRMBee2:nam12UCwCdwxySfDMvwXmBeV

  Score

  10^/10

  cybergatevictimediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2