Extracted

• • Target

    f4c084444944140a072c5d82dc5d293f_JaffaCakes118

  • Size

    540KB

  • MD5

    f4c084444944140a072c5d82dc5d293f

  • SHA1

    1767d40615e80c0ec78cf3dcce7e20ee65687485

  • SHA256

    cbae05d6d7f44ac313573ade98574bccfa4018ab6316d7793b051058d604797d

  • SHA512

    250ec8932a21996ed43cb8d44d25847967ebaafaa480769e9d80b9f773ee136673955e99f1a8f1aecc2a4bee9659bc13cd581084d6b44a6b3befc7866cb3bba5

  • SSDEEP

    12288:+ws3BcN2emjotGtuy6H8eAtpVxagSCyVCbS0jYNFXifvS:+N3BWmoElNSCyVCe0jYLy

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2