Extracted

• • Target

    96de49488ccb9fe5bd709a24d95d6907_JaffaCakes118

  • Size

    849KB

  • MD5

    96de49488ccb9fe5bd709a24d95d6907

  • SHA1

    953f666557cbb7f64e189f05c1aa0a78db700d08

  • SHA256

    3a5cac6f2217878c0e762a3aa4ae050c33298d75104e72e4c14603fea68b91de

  • SHA512

    0e50b35ced20f57b2c2733278d20a18847c2794240aa65cc8c7f6f3809cb2bfd8c85e47d52aa29c435193f8601bdf4327d628e38a4b52bba8a81add5348ec6fd

  • SSDEEP

    12288:yHY1nX94o6tvJsegglMCOnHu7Y9Nge5VbJ1X+H6iBO/Pe6NLonD53VnWW6rP4BZG:GJgR4/

  Score

  10^/10

  cybergatemitzadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2