Extracted

• • Target

    JaffaCakes118_6857f1af2c6a5e14c8ccdc8b3cd9a70e

  • Size

    343KB

  • MD5

    6857f1af2c6a5e14c8ccdc8b3cd9a70e

  • SHA1

    22432c1b5db09a9261109fab73b7e539aee6eab5

  • SHA256

    c00b0e41daf7171e62f98292cbf927913f8dd0cae96f5a4d253512f4c9afba93

  • SHA512

    72856f31474cdd9565262c2431b35a0f4cff50994cccec2b3251195861d66f198c3249b9a1e22b7ef1246481e34953ebc397ce83774f8c1b724dfe5b54f8d66b

  • SSDEEP

    6144:DigBPvwYB5V8yy0d3pY3w7/nmk2iFpjfq4Mo+vjZUD3aueN0tglOeJnfAm:DtBgYBo70d3pPoizSA+9Uj9Gmm

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2