Extracted

• • Target

    e53f8d3e4cd4f334f08a3ffd3fa0bf22_JaffaCakes118

  • Size

    507KB

  • MD5

    e53f8d3e4cd4f334f08a3ffd3fa0bf22

  • SHA1

    1eef40ec3e6574db384fb1a312051cdee3cce5ad

  • SHA256

    50f007bde341e39b9f2c483cddc2d22463c4673f0af18cfea86ca96a7fa17edc

  • SHA512

    4b43cc5ea05bfb61a62529c94aec2eeba6ddae8464ec93339a336c02eb7ba54fd372ccecbbce385c2ee8afb55a7bb2e3e57ed5814635af6d349a91d33d7a5009

  • SSDEEP

    12288:aXXP1Q+A7eHVOBaug/ZB/mIu2gxNwHWhcYho/4wKn:a1QR7e1OByW22b9ho

  Score

  10^/10

  cybergatedcfreebuzzdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2