Extracted

• • Target

    ffdd2984f8e1cab7be015613051ae243_JaffaCakes118

  • Size

    1.3MB

  • MD5

    ffdd2984f8e1cab7be015613051ae243

  • SHA1

    647d2b9a8fe67417ab78ce2027442f670c7ab858

  • SHA256

    69fe622a5342f4e4a224137a01001dd4f55d6b12a9bb4198eaa537a7be0d70d2

  • SHA512

    bc5266dfc2ad0a584c3777769dd9d30e91fa64116486cd609a35a50cc9678bc5fbc733e565f604678d3903fe06cc74fdf6dfc97f51ea285cc8f5b5b5c783e825

  • SSDEEP

    24576:KaHMv6Corjqny/Q50Xac1y0TZN2i3pS4HVr8:K1vqjd/Q50Xng07fTx8

  Score

  10^/10

  cybergateybdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2