Extracted

• • Target

    f7dc859fb3a961c08a05312fd50e8383_JaffaCakes118

  • Size

    367KB

  • MD5

    f7dc859fb3a961c08a05312fd50e8383

  • SHA1

    845a455d43f3631b050e1fd252dd3c3bf319c0b7

  • SHA256

    a6ae05c10303aa29e7bcae9b0634b5dd7b1198aa6b7cbc49a7418118c947f61d

  • SHA512

    5f21814a55887ff7f4dab2c7b969b8d117e87dc05631376339e52a612437951e7e4a1b57ffcdeb8a0d403db9be91ea913fc07c329515499238100e04dc6bc627

  • SSDEEP

    6144:cdvVjqqdqqqLJqkdh/zn2g6Z7KNaSCvTYorUikCRYgbChYm7xBxk/kW1ny2vKQvR:dzT56TtoRCxGxA/t1RUSIZEc

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2