Extracted

• • Target
    jaffacakes118_51da518d7f5d49079797352ede1b52a58e37f32e9c2f65b8322950689bd3c20a.bin
  • Size 1.3MB
  • SHA256 51da518d7f5d49079797352ede1b52a58e37f32e9c2f65b8322950689bd3c20a
  • MD5 3a39215ed6724f23579ae4d03f0912ab
  • SHA1 43f6bb9f5f8d45921a1c475dc11e408d863b7cf2
  • SHA512 2d2e4d502155f5a6311c9627fa91453e2871770e8fd0edf78d5eba53d9637aa4f7eb6f19ab71c4a7b62c7234e28b216e20182bf2834021300d3b9b7ea6feda5f
  • SSDEEP 6144:tKWh4cC/GoePEIzX3tGnIoM/JRueLDz2QJvt+X:MW+D/GPEIzX3tGnIH6QJU
  • TLSH
    T136650E3E1CFE413B92B4DAEA0FDCC476F884E27730122A3AA5D755569749C406AC327E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cyberdiscoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2