Extracted

• • Target

    JaffaCakes118_199294300407e9094c1aa18257b6d2e0

  • Size

    1.3MB

  • MD5

    199294300407e9094c1aa18257b6d2e0

  • SHA1

    e4dd85da094138abec2c61e08c56265730e13250

  • SHA256

    6bd948201b8ed3303fa4a1b37694876753844fddaee24bb5d554d48a5d69d3b5

  • SHA512

    7fcb6f27f04acdbc90fa9bc390ec279f51c7b8fb52aa8b8d42994270fdd29d41505bb31782108ab7bb324a498d14baa266e07546361a53e81c1ce3de421d939f

  • SSDEEP

    3072:oMELUF88rLC3FLKknX4LdZq6YMD0OUZsIKY9FkpQCc1N8+Ip54I/xOJJG32CRNmR:hil4bT1Wx

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2