Extracted

• • Target

    JaffaCakes118_60a0acfa1c1d592e92ecddd4aaa9d540

  • Size

    368KB

  • MD5

    60a0acfa1c1d592e92ecddd4aaa9d540

  • SHA1

    daf5f1a469e2132c60503c13ee2ca16e61387211

  • SHA256

    37aa4221c995ef069ed41428f6998020ad9ad063189374e16edf58e8fb58be1b

  • SHA512

    b6744163a5991bc1dec092adfaab24b761fccf9ec5d8684fa2d0d5826aa93a84e683ede71647e47cffae0c96ce96f559752156afbb2ffb737744213893d36b1e

  • SSDEEP

    6144:H8EwHo5aklJexk/Qmkx0DZ2kHVpn6bE0oyPYib7DQQqO:cEvvkijH76wyxbYS

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2