Extracted

• • Target

    e4bb9ce383229b89a24ba4de1efe0eba_JaffaCakes118

  • Size

    332KB

  • MD5

    e4bb9ce383229b89a24ba4de1efe0eba

  • SHA1

    cf270a7dbf875c13a0e2d6b4c8ad8a3fcd8b2ef0

  • SHA256

    58317f1b2502e5c65784e856760d61fda6544b74df0a6a874a7b975752e2228a

  • SHA512

    c092257aad3a8f34f2b36ac8237e42b3fe2d3496d4be717a7c5bd211659914223e0d4294de14381805c33e563a2c6320b436c19da1bb78c14a44ae3574bb8d3f

  • SSDEEP

    6144:AJNa3xJYknqABzWGrxbo3Ru8s9oIeK79pRgWrkNePOjX4JeQl1DP2rx:A63xJYhAJ/rx+CoIe69p6WrkNePDJVz6

  Score

  10^/10

  cybergate{{alwasn2}}aspackv2discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2