Extracted

• • Target

    c9368eac09368fb150223648161f134d_JaffaCakes118

  • Size

    320KB

  • MD5

    c9368eac09368fb150223648161f134d

  • SHA1

    31b3efe1fe559ea8fe76cf4988a415a1e473e16a

  • SHA256

    d406e5af54e001399f6a74954980d907d80c954a74f5103a27738833f50e224e

  • SHA512

    9a23075ff8e62994eebcc360d026f75fe28b7440eeaa4d8a52c3741b0bbd139aaa0cb2492e8c0dda7127e9f2f319e9311ae0cc57a7c0e296f03e50849e679d4a

  • SSDEEP

    6144:AjlGZEsGbuVgCJC/XzRT4/IiaUfCzGrcyT3RVKG8spFu21BU5IPGH:Ac5CFTaIiaJGoyVVKj4u21Ceu

  Score

  10^/10

  discoverycybergatecyberpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2