Extracted

• • Target

    cd7bdcae44da7f0cb6598550fd625d97_JaffaCakes118

  • Size

    668KB

  • MD5

    cd7bdcae44da7f0cb6598550fd625d97

  • SHA1

    a28856d03813beacbc1db0893c343be6306d10c8

  • SHA256

    c7662338d6c505346fa9314b4b5a735a7de745c83c66c736d66408be67f4b1cb

  • SHA512

    9ee172068cdc21e4fd6de5f202885bcae950e4018e4d056b9591360cda7e501d64e1238fcf628d95e24c5ab2f1693cf2e340aec8bc827a2f60d4d21ef738179c

  • SSDEEP

    12288:JZ2z20oPp6eRT+PYiFEG50bxiZ6jyPyczQdvqgfq:JZ8kT+giFtpb6AQxf

  Score

  10^/10

  cybergate55discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2