Extracted

• • Target

    JaffaCakes118_76d10accb5712c52ffd7efa87f2d6071

  • Size

    1002KB

  • MD5

    76d10accb5712c52ffd7efa87f2d6071

  • SHA1

    6157d5607c19e3db82809623d154729cf8b2f561

  • SHA256

    a795dc40d6d2ed1134bf410b5daae50d2dc91883a4696e0a11a62ca9ea6612a7

  • SHA512

    75da185ef66146b5e8ef5ff5b10046a8d1655f950eba5d9e93f5c1670df10339b4213ab78111a2a36ccd8c56a6c233edab61eeead05ed4e1ca69ac84025c2b41

  • SSDEEP

    24576:b1dlZo53jw1ujd2wTnUyMUknbvFDtSv6u6QXxe15L0cN7qMZs:b1dlZoE0B9obTSNhevhWMZs

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2