Extracted

• • Target

    fe57df0f0719a5436985058227824116_JaffaCakes118

  • Size

    562KB

  • MD5

    fe57df0f0719a5436985058227824116

  • SHA1

    13acd701c0d70cf433b96de8289667f3c7c1dcc1

  • SHA256

    30de9b024e037d9c2e465936e583e637e2863c93a722b67a47f58b43f8a41459

  • SHA512

    80f958ba3ded209ce1a3fbd0dec25513c8f3d60410f73bb82c24d4c9bedf83628becb50e0c693d318c74110b5a8e34055d49821122cf5980ded63d096607d8f3

  • SSDEEP

    12288:qHLUMuiv9RgfSjAzRtydkNcwnmcKwZn+lspCqNNS3Kk/yPTpgA:ItAR4kNJLKwZ+l7qNpk/6

  Score

  10^/10

  cybergateautoclickerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2