Extracted

• • Target

    JaffaCakes118_53cece3849727f63f8cb55504f78a7ad

  • Size

    417KB

  • MD5

    53cece3849727f63f8cb55504f78a7ad

  • SHA1

    7f2e9dbf706a82b01cf717d55c452ef5280e604b

  • SHA256

    1fa58e46d6f6eb8b3f020f9715d1f909695b1ebb3625cd1deeb8d34026a7c923

  • SHA512

    9dc2cb45df1a4d31728a42e1a06da71bf45257e5d3d187936a808728ae9512fbc67f88a9da26f650554b3ba0232ea97b9450f50f7ab1ef389223c89a2012d7d9

  • SSDEEP

    12288:9w9oA8xa7DdAIFEGmprmBv01+mOib5u7JurpG2gRTu0G2O:2GA8g7DdKrmBs1+mOiywVz2O

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2