Extracted

• • Target

    fb2a4c24fc02080ba250b847f8dcf26d_JaffaCakes118

  • Size

    478KB

  • MD5

    fb2a4c24fc02080ba250b847f8dcf26d

  • SHA1

    40383a296a7b53ec29bfac638132e85007f92fb7

  • SHA256

    a69685e70d2ce14719bc188e77349b93ae7c6094ee5db389e2f1101e513007a1

  • SHA512

    41b88befd6c01fc6ccd60f3e453cab1ad58a8519240087497b22cae09d3e36ef2655f2a52cb2ea7925becd367a4f4d299dac63597413d667206c52140e05c8d1

  • SSDEEP

    12288:WLo5y90LfPdj96lmf4Tup4aQRgcRhPWmpa:7y2j96kAvgUhPf

  Score

  10^/10

  cybergatesoundiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2