Extracted

• • Target

    f56a56e901edc9c07bf9ff90a5432c9d_JaffaCakes118

  • Size

    623KB

  • MD5

    f56a56e901edc9c07bf9ff90a5432c9d

  • SHA1

    6f52342b1ba3d0d90259337fa1dd54f23edaecb0

  • SHA256

    dac89a4f732266b30a78562e87cac11a941bf6ae1cf3142628eb3afa1805aef8

  • SHA512

    e8b5b3e59540f2e1d945e4b854c8a14ec1c084d42c5eb0db57f227d3ae3356e11a6672ce95a1a9e8e14a4433afffe1ea77721914ef370333c9b56bd0a68cf67e

  • SSDEEP

    12288:V5SlClj7vViY/sGMvDZjhxr+fusDwH8K/lGRgOUqmq9kR6lhKX/dcmq6czlJ9uV7:VOClj7vVZ/QvTxriK/cRgOnmq9g6i/qy

  Score

  10^/10

  cybergatedelphidiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2