Extracted

• • Target

    fec381adfef229c579e976552e7c640a_JaffaCakes118

  • Size

    1.6MB

  • MD5

    fec381adfef229c579e976552e7c640a

  • SHA1

    af1a75b3907693f9c933a8b36699d4d63811f824

  • SHA256

    877fcdc6248d7582c17bc98f521718d5b3a6cb23eb46858082c7947d3987a174

  • SHA512

    fbaf11a2613d0b78194dd2103e963d61bfe47987206328f1ba06859ef5b2c965043c6b046e1e919c9aaedcae1fc1a59f2fdc6976c2cdd8bec30415de1ad1cd05

  • SSDEEP

    24576:NaHMv6Corjqny/Qj5lZzL+yCdJzhiZuCOrCT/kh0okOsciBLHZeULhLaB:N1vqjd/QNzLApUbYwvcGrsB

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2