Extracted

• • Target

    f4cfeb8dfd8ae8d561f0ebaf58a749ad_JaffaCakes118

  • Size

    312KB

  • MD5

    f4cfeb8dfd8ae8d561f0ebaf58a749ad

  • SHA1

    53502d56eead729701b14d259ba09c3c0937f29b

  • SHA256

    12142a468a73bd855f6306bc0a0ce7d0d9a66f34e5d1e5bbbe835afdf0e2f42e

  • SHA512

    b7d581792d0cf9de09f80693a995a999ddd46d5e39bb3ce6d1eaf40122d3f2dcabb984c6a033771327569496ca3acb453110f145d7f065137e5dba15627ed4a2

  • SSDEEP

    6144:qLev7T7cphJVlveCRuhwf6xC5vJeeU9AfS6NOvkLJgEiv1mAk5D7u:qLwnWDlvpUvU5hen9q7JgETAkw

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2