Extracted

• • Target

    JaffaCakes118_054ba4ebf8221b66ddf8cd77c2a48b66

  • Size

    420KB

  • MD5

    054ba4ebf8221b66ddf8cd77c2a48b66

  • SHA1

    7efec6e9c44a5926ecebfc6df8b5d01af0169948

  • SHA256

    4eea280b3f8d70de9de0b9b91b6d41a68afcb2c85c05577979921bc316c4269e

  • SHA512

    aaed75f09e729499c37aff241f05f01e6b0d155b8ee2b478407072a2ecfbac9cbb00b855358ba9cffd0eaca908c9edf89e465a7980a6b7525588185d39ceccc6

  • SSDEEP

    12288:t4ATXrY4PGisyf7998/+FwXRLt98Odlcql3wF:t1T0mY+FwXRD3

  Score

  10^/10

  cybergateteddydiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2