Extracted

• • Target

    e331363b3f22a08e56bfca8c5d77fe3b_JaffaCakes118

  • Size

    420KB

  • MD5

    e331363b3f22a08e56bfca8c5d77fe3b

  • SHA1

    94cf20ac50216168854720c0624fa7b9bb2e4ce9

  • SHA256

    5343d0e0ca1729b3de64756e4cab745ee79f5939e1f785a967add2d76b55789a

  • SHA512

    17fded0c6bd58d8c29bde829b8d891d88ea2e6733522aa30e628a085329649488d45f2c287e1bfac769c0c2fd5a556006ed60b17b2d669b09a9588d37ba0edc9

  • SSDEEP

    12288:R3SMpG5CYPmUjd/AUJxTy2MePqgv5N1Rf:R3SMs5CYZjd/AUJDrPb

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2