Extracted

• • Target

    eb13c857ad1b4f77b5e724732e9aa24d_JaffaCakes118

  • Size

    1.3MB

  • MD5

    eb13c857ad1b4f77b5e724732e9aa24d

  • SHA1

    1de341cffe0211d18ff1fe14bbf311bf096d39ed

  • SHA256

    1241486206315f9150daf36e93d9a2741bfc93137888240fcf26ab578c66aa29

  • SHA512

    f6bc67c591d76e4bef3ca36c16b25b8d163c5b504e995cad0840e51c2052a8fc29d5eb89c1248f7da078ecd632bc17be799511f29f3320b6df96829b7f571a05

  • SSDEEP

    24576:RyQQpDxCscn2KQGNcgQhYj2I4lugE1nPZUD:OxCb2KQGpQXI4A1PZUD

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2