Extracted

• • Target

    e2d4fc632d9b2a19f2769781dc786cfe_JaffaCakes118

  • Size

    606KB

  • MD5

    e2d4fc632d9b2a19f2769781dc786cfe

  • SHA1

    efccc9c6d199a3f4d50fd60ce473761c3d1fc5e8

  • SHA256

    e6b15b102add49d550e2d6ad4aa78224603f230d5810b86f5413c24e04270d83

  • SHA512

    c7d75c601d56a78dc48d8ecd69a0e38fe02504802bfa305014bd1c40f31998276fe03136d965e9d28b8b410cf68d1075efa98f893f2912a293cdf69631a6403d

  • SSDEEP

    12288:JBMmKGnhDT+JlC8bCbA03qkcnBf/siTzCt41T1a4Mv:vMmnDC+8+0UneBM8CtCT1kv

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2