Extracted

• • Target

    JaffaCakes118_7aed8b72d17478290723aa7cbe8dbc00

  • Size

    463KB

  • MD5

    7aed8b72d17478290723aa7cbe8dbc00

  • SHA1

    b4cc64d9afa5c9c03e18e1e4dc3725fbd4d986c9

  • SHA256

    0a416a758710a4c75707a5f71c2bf4c8b0cf3787b273a876d9740a1f53c2c36f

  • SHA512

    0c02cfb24566e82512e44fb3dba854cb8e98d73ff7abfcf25130598e9cb2b709e1b0f1d2231f7234488f29fac35868bc6e001a0eba8aecba830eb3a942552a12

  • SSDEEP

    6144:GlAMD0bSdyAujir88e0LLi2re8tnhrtaH7Dh6J27m7kgcOeiU93qZqscOPEElzpf:GSMD0bSdyAJveihIv10eBO7xlvn35UW

  Score

  10^/10

  cybergatecryptosuite_victimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2