Extracted

• • Target

    e44f70d7d1b9c185e3bc419e28ce6e2d_JaffaCakes118

  • Size

    476KB

  • MD5

    e44f70d7d1b9c185e3bc419e28ce6e2d

  • SHA1

    ac5d94ab2c5d2c7cd51f7f3b7656ae6908fa9440

  • SHA256

    f1521017831c700cc9049b7533fc03ebcc331e8ead37e473d1a980c3bff74189

  • SHA512

    2abf01ddfdfd32afdf9114eb29943371fc3ee83ba2478b1a947c5f1fe4057c71e5d2fb9c259d4fc21138eeb23c18d0438e4f728a7ce2e652d0dfce7d2241b465

  • SSDEEP

    12288:BFzP9jHTYIIIYKiBL/IRz61z9ycaRoP8RZ9:T9bpKBL/jbgJRZ9

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2