Extracted

• • Target

    fa5ed2a427b2c365241d2536a23b21ab_JaffaCakes118

  • Size

    436KB

  • MD5

    fa5ed2a427b2c365241d2536a23b21ab

  • SHA1

    ae6b3014ea218e7973f693699ccc8bde05f122f5

  • SHA256

    3e7fea4a47a46e0cd26fa13fd3e3f227effd5f0d1311ebe5999c1d8e74dd5514

  • SHA512

    12b130acef79b7e7e6128e6f818e59ab3198cb3633dc859c732165ec85166946e37153a38ab9aac7f6b9c7dbed29f452f95214937512da0604dbfa44bdf7a592

  • SSDEEP

    6144:xN1UszJ6gSbP1bMDWPcn3IG7cG1fbi38i9hndQSzjiL0t9u8ji4S5m5kcxar7Okg:xcsd6g+CWN+fBivnPWgts8yxcxei3

  Score

  10^/10

  cybergaterrrrrrrrrrrrrrrrrrrrdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2