Extracted

• • Target

    JaffaCakes118_6bc3084ef882f5bd2220718075376558

  • Size

    328KB

  • MD5

    6bc3084ef882f5bd2220718075376558

  • SHA1

    8d14a3baf65a9f7afbaa5de95572064994c8c323

  • SHA256

    686e545f78c2b2df774fac35dd652956256758dd98e56e27a25aa62d2634ec85

  • SHA512

    b27272be7112e11cbaf7dc7a8e9c34137cdece45340dc042183bab8a45b3309560d69fcbfd3d08bea90380a7e720f18450da1cd1b9e18cfd235b3e24ed881b50

  • SSDEEP

    6144:ZFEwsj2WEVIfH5uMrxvTm/S7Q5I40iFSIHi2CQnM+BtIOzh3y3:JsjaefnrSQIC2w+7A

  Score

  10^/10

  cybergateöíüíédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2