Extracted

• • Target

    ebfcfa6f0a74ddeccbf27a51ad6d618f_JaffaCakes118

  • Size

    553KB

  • MD5

    ebfcfa6f0a74ddeccbf27a51ad6d618f

  • SHA1

    2c7c4c79578ada050aa9f63d7d49ba134b95feef

  • SHA256

    0a91ecf7434d82b7ec4fc5551b3e92d40c8cb2efd5643aa78e8aed8d6ce86d7b

  • SHA512

    6b84b5faf23dc2c8d0b769586d73ca7cc72d35e5edfa86c6ef108e784918e1b866e5f6f49d3f1e14d52baed7d18b0df86db59c95f0da5f049c4059517c06a8eb

  • SSDEEP

    12288:ABMmKGnhDT+JlCgw9njEz5Z2e3PykQM0E:SMmnDC+XVEKe3PBp0E

  Score

  10^/10

  cybergatevictiimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2