Extracted

• • Target

    JaffaCakes118_69cd3b7279972b8b37c5528b08ea7685

  • Size

    358KB

  • MD5

    69cd3b7279972b8b37c5528b08ea7685

  • SHA1

    d44b99b53fa5b1b078cbc4024894263129333a1f

  • SHA256

    2798e0f44a3bfa2cd01d18470d9e8c0b8d18fbf7feb705aa2681f766383f33ec

  • SHA512

    029e4cb1cdcc07b4cdc17e6e6041dd6d4f2e1bf0c8992288ae21f011dbf39d55332497528a49dac022e531d3d8b78ae21ac6ce9e43d5eebbe16cb6deffdccd83

  • SSDEEP

    6144:339oDFlMIlwCcgHFqQUNjtiMbtJMf7MkNKDwIu4svS6pDGHPsZkh/:339GFiI6FQAx1JM4c0SvS6ZG6G/

  Score

  10^/10

  cybergatelammerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2