Extracted

• • Target

    f0561e4518fda9fe16fbbf88fa0c1a7f_JaffaCakes118

  • Size

    1.3MB

  • MD5

    f0561e4518fda9fe16fbbf88fa0c1a7f

  • SHA1

    bc7c6d68634c736e2ce10efeada7c41bf0ca48a5

  • SHA256

    c6878eb87d8c2bc8623a6964d5a7d5863efa3cf4fb7c378c30e40de5fc108528

  • SHA512

    6e9f1b05904f8459b5d58cdfedcb014e92f9fb00c4d0dc643d1b1b7dbfd6dc5d91559f36f95f4bee4a2b070762d610b8fe2134ec896aaf8e18dfa9334339d718

  • SSDEEP

    24576:3PIl9IURs++SZEPHoSHgS3rALGc5L4sG6iymcz6nYRA4VMO/wpx5rXytZ7cRQ:3PIl9IURn+SZEPISHgyANOeXUQ

  Score

  10^/10

  cybergatehijackthisdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2