Extracted

• • Target

    f949ef2edb50ace80fb306e966c492d4_JaffaCakes118

  • Size

    432KB

  • MD5

    f949ef2edb50ace80fb306e966c492d4

  • SHA1

    555f337c9533b9eaddf20c397cc997b67f879e71

  • SHA256

    3a8c911cc974ea0bc820f87c9c82cf24f9968ab7b15982ef394b124b3f83fe17

  • SHA512

    a2d7efe99ed95f83789915fe661ef22f1a0412a92ead4b1031207eecac84063eae0e12703d5b724cd498a2a580ecb5323d62b99b196ae909340141c6e1e14d36

  • SSDEEP

    6144:ScRE7xHKHSspiQgST6HFFhEyncDNIyYVC63RSu29lavMmWl5PGxNCK5SHSC03oAi:9qxLHS+HF9cD6C68TSwmN9SyCdjm6

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2