Extracted

• • Target

    e87bfbb255f35c3762a5e7c648584f1c_JaffaCakes118

  • Size

    344KB

  • MD5

    e87bfbb255f35c3762a5e7c648584f1c

  • SHA1

    6aa9f14ab1f3aa9a06a40e6f3937ad173c9451ad

  • SHA256

    5a248309b53e388caac417025c5e903e459ea0cb74775555b73a19c0ba1497d2

  • SHA512

    1eebafc75f32c855c8268d2d4e6ddf5977b92d9ccf464ff5bfc51669d5c171a610b6a6ea4150e3c13975d87d98a57d8cd78d2e36dd77bc886e6673df72f5992b

  • SSDEEP

    6144:0S73l03Xw+tVPr8Mu5sG8GhXf5WJE+Dy9mDX2sk7zIOcSZrKDXv:X710wYPrlu5sG86hgI9+ozaoOv

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2