Extracted

• • Target

    JaffaCakes118_76fa48938a1a3ede8b7f6078c3a6e8e0

  • Size

    334KB

  • MD5

    76fa48938a1a3ede8b7f6078c3a6e8e0

  • SHA1

    fb435fc90a7793e26160452be80bf3fa3591915e

  • SHA256

    4b58e679211942a2962575f8a77066ddd5b3beaa10dead390916f574c18e8712

  • SHA512

    cd7fa47119b7a56f4727e566a47748efe12cba4e454c6d9cf3189e2e21e820fe0a1a72a2bf6c097a6593cb7b9af2d8eb1d2872cb29351bf3313f35339c222884

  • SSDEEP

    6144:kxa4ZWcFIXqwk9N95L2plx0BmXdgg4hAVVPFx0XFxg5ylqSTQ97gY4XmUryoN44i:SZhFEqN5LGxttEur4FeSqhMXyoN/X

  Score

  10^/10

  cybergateêã çáïúódiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2