Extracted

• • Target

    ef7aaabc1eb9e4a86af47dd17f0a5bfb_JaffaCakes118

  • Size

    310KB

  • MD5

    ef7aaabc1eb9e4a86af47dd17f0a5bfb

  • SHA1

    f2e771aad0ae7ddee8c1ca66ebbe424d18dae4cf

  • SHA256

    dbe803e3d626744f312b79420dd9cb14ba88b540ae7e046f35a5b4f8c742f036

  • SHA512

    9204e88daa3cfc5ee59f5faad85c905cff668ba2d99e273009e2b4cebe1723774ba9f66c85286006d5bbc8a949ebb65ecd1fc4d70f32d36c5029e9072d539f83

  • SSDEEP

    6144:FwjZgcuINqN1nhRPOJhfEqjXImW5aR1DWxlL11VfrjEBytDE25M5w:FwlgesPnhJoBj25aR1DWxthrjEBWE25L

  Score

  10^/10

  cybergatetnwrestler360discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2