Extracted

• • Target

    e4c42d3213ad8afe6fa27a08076a5527_JaffaCakes118

  • Size

    469KB

  • MD5

    e4c42d3213ad8afe6fa27a08076a5527

  • SHA1

    741e57940d64982779a272f95e3fb9661f1191aa

  • SHA256

    02c5dd68fcc754f3604884ceddb707f38a092ddfb4955e70a25af5975e0d3b2b

  • SHA512

    b881691b094140ae603f5a1129e0515528d5663d8d2d35595c418eb4a6a49228bb3ad82263ef095e3b76b040a3896f8f2d10229446631720a24ea962fe01a77b

  • SSDEEP

    12288:Uw9pAA0o/C8Bl1z9L+gbOMXmZuD68wnl4:UmHJDT1z9lCL4

  Score

  10^/10

  cybergatesoudiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2