Extracted

• • Target

    JaffaCakes118_62cee7d7f1fbaada7931062c6e82408e

  • Size

    659KB

  • MD5

    62cee7d7f1fbaada7931062c6e82408e

  • SHA1

    a31ed16324fa37847323a126dfc66305931783dc

  • SHA256

    85886e4201fb1b113fdeb51ae114acf9726021884637fb4788d273a9860588cd

  • SHA512

    48c9d27252f8692e36e8894f943c894f9b045e4a6b36b7ffc89659a7c17a7afea4749dd51e31c401e9c82a1901619db7e5c764eccd4038a9e2f1820e0ecee780

  • SSDEEP

    6144:gwLW1jVp0oyoMGGGGGGGGGGbGGGGGGGGGG6GG/DGXxeXJE85PmWyVcjUkdHbIIA4:gwK1joKHjlEONo6BpW8xY3K3CgVoo

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2