Extracted

• • Target

    ed079d52e15de78e0201b3d545eec822_JaffaCakes118

  • Size

    340KB

  • MD5

    ed079d52e15de78e0201b3d545eec822

  • SHA1

    42023befb9a571bfac3a19252d2168d5a9d69f62

  • SHA256

    1ec552e77c4e7d7fb918a3795362c6396e5ce1e43197b77cd8a037a8b6170987

  • SHA512

    5724b13d70bc1c1a60353f58b74e65155631d037565b88a65171f3a85771c9731d28eec8764346816f9485f1efd8d09395181d8a4945f0839ed5da3d5753889f

  • SSDEEP

    6144:KLDgCvzdyWVFe9REpJoME/yIhtmQdaAwRvktVUIGHuIgSwNCAHQ:+zd7uRcDNITaACktVUrdggb

  Score

  10^/10

  cybergate2msndiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2