Extracted

• • Target

    e4203939af6005948bc7b307a65508da_JaffaCakes118

  • Size

    539KB

  • MD5

    e4203939af6005948bc7b307a65508da

  • SHA1

    1869ccf605e4af7b24468d50f2b78b6c6493a245

  • SHA256

    b3472ca8bd39c23f2b5856425edbfe30de978e601f5a5960a294690598e99abb

  • SHA512

    ac3f8a55c540911cb523d055696cc2e7b124c3dbeb76997587c215c9801e39400680f9d4d7dd745336aca0b6450dd155e90a60766aeeed177b8bd6211e29f4e3

  • SSDEEP

    12288:Acnnmh337eUzDvFOZisuqNdR9rFv57mJOLZrd52UFDwX:vnQH66OHuqNdRdtAJi5d4Um

  Score

  10^/10

  discoverycybergatevictimpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2