Extracted

• • Target

    ee9679742c5b6d9834f3b819215a9316_JaffaCakes118

  • Size

    467KB

  • MD5

    ee9679742c5b6d9834f3b819215a9316

  • SHA1

    21c9c966f862b8cc98c58aaa120c38183a645b1e

  • SHA256

    ea1f1b1b89b03ebd2c453b41462173a6154b571c1ca40f2c2c922683eda6c617

  • SHA512

    42ddf27d750c58e803ce9945d1b9e842e4a8598fc27b8ba11dbad64ca602deeb24fef4439be1bc6404158cccfbf0c5084135498f89da85452ffa978acfeccd1f

  • SSDEEP

    12288:hb6nM/zWfSAazfYMFZON11N7gF9Wu/C5xnzkG:hbt/yqDzfY2u1NkfWuEzf

  Score

  10^/10

  cybergateto7adiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2