Extracted

• • Target

    JaffaCakes118_42f7269b65bcd5ec14fc4d0f514c7d4a

  • Size

    396KB

  • MD5

    42f7269b65bcd5ec14fc4d0f514c7d4a

  • SHA1

    ec459b0f479d3d4688ab169171775d7d1f1cc2ab

  • SHA256

    4cb8af287c32e6ebe81d7be0d96e2cf27a081ba23cff8d44e49bd12611a0e4a6

  • SHA512

    44eb45a0127b81707fda99decc731af6a55e21976b624b77bbcbb263f0b1ecd02471a9d9a1a48af398055f20ac144a3ed5b0498c03b5b236940e33ee6077df91

  • SSDEEP

    6144:VRFY/JO+HQ4HpsLyuueZFnIGla6dq3fKndQINDys5P+mqt7:VEJO+dsLzTZhIkWyndQIsVt7

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2