Extracted

• • Target

    ea04f679482bb54abec8eae2242c7c23_JaffaCakes118

  • Size

    703KB

  • MD5

    ea04f679482bb54abec8eae2242c7c23

  • SHA1

    59f79276d06270c4d9f606418a5242676eb8707c

  • SHA256

    8039996afa6f84d9b81e1450e5fc7d79897fa778e45946c20b0a68cd2f50a1cf

  • SHA512

    8a9af8c574fc8ba04d1672490fe705cf0199c2e24f0d39e42178c74075a66b9133a61185110e8f486af9124df4b1af2f66f425815ea9bda7b4c0aa33d955dbc7

  • SSDEEP

    12288:JHLUMuiv9RgfSjAzRtyXcQVD1QSXr4rjfmnO8DsWi3:xtARs3VD1Q+8sO8DsR

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2