Extracted

• • Target

    eb3ba46cab007b8209063def363b9ee5_JaffaCakes118

  • Size

    366KB

  • MD5

    eb3ba46cab007b8209063def363b9ee5

  • SHA1

    179e3143b16c3993f9a614f26e83857711b90d1c

  • SHA256

    c6accdc9dc2affa8e424fb6bcd9a60a6d10a50a7f2b4051a08c2682ee7cb3ae0

  • SHA512

    ff34196a3d4323c9406b0a3ab22df12ddd415325dc5480e9d559c7eb07a5ca920b3e09ee91857c2e4a8c8d885216b4c35f82aaca973aa402017dea0f003899c1

  • SSDEEP

    6144:JmOMZb76zAuvjlj97E3FuJLr3zvXTj3/3ErQj3NhOB+ZNXAZW31V3k5PHzlGmGDt:JmOMZb76zAuvjlj97E3FuJLr3zvXTj3P

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2