Extracted

• • Target

    f2cdb8a246597317ecbd420497844314_JaffaCakes118

  • Size

    309KB

  • MD5

    f2cdb8a246597317ecbd420497844314

  • SHA1

    42d8f7c3a4c2933c005e3d2326111e3bc59d6efa

  • SHA256

    4dd7330bf0c3811eaef57244cad645c6112a0fac41143957d70f3287161fb96a

  • SHA512

    c89943527ed95b7deb678ac2493e3f5d8b1a40b66625eec0de94ce7fa26b2de442373e7435e6570919570bd43016ca3438edd750eb0b3ff92b694bd41fedd8a6

  • SSDEEP

    6144:ntmAJTPah8muW6VsVjHLAVOt1sWEQj+x68qQCHnjSKTIAIjiJb:3JbMFVLFFEQjLfDSKT5Ie5

  Score

  10^/10

  cybergatebdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2