Extracted

• • Target

    ef4e36c8383af76c939f44977b234fe6_JaffaCakes118

  • Size

    702KB

  • MD5

    ef4e36c8383af76c939f44977b234fe6

  • SHA1

    d01d7370abedc7bb3376c332e5909ffa29135240

  • SHA256

    61d6eca1213090eeefcc6081e7ea9edd0dc6d1f5eebc758a31192828ff26e324

  • SHA512

    98bb6670c41a99cc518291590062a53c4c8480b4968f1d75732df0796feed6ebb72bafe65ac63763d5bc0565d60b2ad1bf892652a16106cc16501f66daa64cc3

  • SSDEEP

    12288:Z6wVuRiO7nH/HEIbNzuNhZ13j/mwdW5UtgiZ6dBrDxfBKNEtBgPcnqZbv3d:QwwcqH/HDbNKZ13j/s0g/BrDBGEtBgBl

  Score

  10^/10

  cybergatewebdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2