Extracted

• • Target

    f439ab99b610130c4452c1ae21ee39bc_JaffaCakes118

  • Size

    610KB

  • MD5

    f439ab99b610130c4452c1ae21ee39bc

  • SHA1

    5ea3e7b5b6ed6a460b31be5d3bb2fb2e668a343a

  • SHA256

    76d6e0d84fe8bb058c18874142ea4afaa8fefc8a4ad08a1f1202142d281226fa

  • SHA512

    232db5559f2ea0192687e92f3a2687b41cd79faac1d95a50fb3a2f33693690f0a34f58fff70c61414b97a484329215cb449a2b4975b83f4070eaee7c0e405b57

  • SSDEEP

    12288:qBMmKGnhDT+JlCu0G6KC2m9QnNSSn7WCNtXQ5JaDYrzUpi86KMl:IMmnDC+uuo/Sw7WC8JaD/pQz

  Score

  10^/10

  cybergateexpst.no-ip.orgdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2