Extracted

• • Target

    f3b7bd82730d8d914777b0b0680159c4_JaffaCakes118

  • Size

    286KB

  • MD5

    f3b7bd82730d8d914777b0b0680159c4

  • SHA1

    1d7a050b4b649cd28a13e2721d40ef114164591e

  • SHA256

    185393af8266580c1f895e58b20e416ad6f30a6f45898eaa66917acd180efc6f

  • SHA512

    103dd65c9d6ceb390d4936b1cc2dc57008e2337c41443c0feb118f38d491a52c842ca433ee2dc2ebf7d089c054ac8812394c6e40212cb2159bf0870e23683fc4

  • SSDEEP

    6144:U08G+S3z1CPtQUwa59gYfZdBFQ1IBDPLIz27RBeOrCeQ3Tq5P1urPG:pj+oQWUw9YfZdBFQ1IVjIz2FtuG54+

  Score

  10^/10

  cybergateusersdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2