Extracted

• • Target
    jaffacakes118_Trojan.Win32.Inject.akujr.8bc49770a1a0c976a9261ed25b0454cf
  • Size 581KB
  • SHA256 9ec7921602a50b0d98326ffa72471a9dfd588b9fcb4488e4aaf762a50fde8581
  • MD5 8bc49770a1a0c976a9261ed25b0454cf
  • SHA1 929e4928fd2fe5e296cf0627824773adc80fd9d3
  • SHA512 4ca77f145b11b7174e7316d4fd91ae54aeeb1307bb679a05e6433247bacb1efaa9fb82b63c5a9e3299200ae8240cbf29fa1fe7f7a35ab8ff68be4a02b031a5a1
  • SSDEEP 12288:RxQQU7Sb1L5rq0McS7KSUjLsY7bcsildpUwH/:nQQU7SqWo4LsY7bqMwH/
  • TLSH
    T18FC44B0571A4FF6AD98DE4F03480C5BA95A6383736705D933EE6EA93D9112C3ACF9702
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hkkhdiscoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2