Extracted

• • Target

    e2b3f1a0f7b0b394114c53b288837512_JaffaCakes118

  • Size

    484KB

  • MD5

    e2b3f1a0f7b0b394114c53b288837512

  • SHA1

    de2aae73661a225e4a8c34ceed589057543e2d98

  • SHA256

    e584df4748b8c4cb7941aeecbff23dcc25fdb0e7f87e2cdcb8c431766225992c

  • SHA512

    b4d180e4cabaed04157be428228d1101921577b7effca8ef4798eddb3b9a4ce44da207916d0f8c4384140d7a51f9f0c6c4db56bb89c5c3859f2397b9017350e2

  • SSDEEP

    12288:9Kaa4I50FbHO5uX14UXCde8lX14UXCde8K:saa4IMOE4Ut8f4Ut8K

  Score

  10^/10

  cybergateseguritydiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2