Extracted

• • Target

    e9946fbb069371c6f3ae23a9087f6d16_JaffaCakes118

  • Size

    340KB

  • MD5

    e9946fbb069371c6f3ae23a9087f6d16

  • SHA1

    bb3975bd1150f984e60dcc1604f925f2a0508e85

  • SHA256

    cdfed0b55245e8ab08b00aa579ee80f6c0191fbb5b514238ac07f8344f41bf71

  • SHA512

    bf75c5fe4b891329ec43594c794bbc607a473a2696f66b567a228f2d2e32979b8262ee807cea642a33c1bfc7df8343e0e80adf09cdfb15372182504d35d53951

  • SSDEEP

    6144:XYp9cIMnhkMDHRvXVu3FpuSYt29ZZlq+2jbs0bsqphdBmsoY+OC3q:oHD8hkMDxoHuSYI9ZZ32jbZphdBSOC6

  Score

  10^/10

  cybergateneodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2