Extracted

• • Target

    f305409f05e885ff16f198083cdbbe83_JaffaCakes118

  • Size

    513KB

  • MD5

    f305409f05e885ff16f198083cdbbe83

  • SHA1

    e482ae6f66eabdb71c5d1382ca5df3fbc58fb9ed

  • SHA256

    84b360ae36d460ee3aa26b8886a528981ac491cb1574964cd185940b11dc1e6d

  • SHA512

    5ca12f93a2de8c935fb8148441f3b16cadfe9b2efa0e9cd02603dac6c0faf784f79582285375a17189de6c3c091d03fb04eb1cd239bc3deb5c52b7ec3e6cc81b

  • SSDEEP

    6144:mr+53Z2qKft4qfCptHpnombbZerXG9dodrujqzfzEu7Ey2iUCc4nLGryhxRW49QI:WiSC/HRhEzUjyfTEfrC1LZRel

  Score

  10^/10

  cybergateremotediscoveryevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • UAC bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2