Extracted

• • Target

    JaffaCakes118_66efe01a9cedcfa5a2ca36add261c56c

  • Size

    1.0MB

  • MD5

    66efe01a9cedcfa5a2ca36add261c56c

  • SHA1

    e9fc5bd0144d63259612d3a2ac1e8ef2996c4bad

  • SHA256

    043c39b4c53ed3d6faf641ba05182dc4f7aaf74f74871a36c8cb6a6a98d7defd

  • SHA512

    9721509dc7402c189cef9e84a8d95f29310965ff0e85228e23c5f26663cd124a1e1a8d501d4908a3ad90769c89a45e1732ea46a1a086d55bd6030bb9a4bd66f5

  • SSDEEP

    24576:xHgAHgAr6yAXbr8RuO0uku+RvLt4SWFo2J4O0qum97zV73+:xHgAHgAr1A8uKku+RvLt4SWFo2mOnumu

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2