Extracted

• • Target

    JaffaCakes118_6f4cdf1475a6c3db8cc16d0fe18564c2

  • Size

    364KB

  • MD5

    6f4cdf1475a6c3db8cc16d0fe18564c2

  • SHA1

    405629a21d563efc2fe149c41a601c668d0af157

  • SHA256

    915f6563b5bfe87de851062b7219fc311b6167bc1ee99a942afc1133d034b76a

  • SHA512

    23222ebdcdfae3ef04a69f3bd9577974ce2686a611f6376b32b708b0e8a037e663c2029b295d7f43cc3018139c7f2998b8124d82766e7c815f1680db31086d2c

  • SSDEEP

    6144:ThNtPtd63dAv1+66gj8nzs9m0Nv95X+B6VmKJUjjoevsm7dTo:TDtX63yU66q8no9m0NHfvJULd8

  Score

  10^/10

  cybergatedofusxddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2