Extracted

• • Target

    JaffaCakes118_729662b5b735d92ff3779be32d1a2273

  • Size

    992KB

  • MD5

    729662b5b735d92ff3779be32d1a2273

  • SHA1

    242eb7330404729a4107cb3666a158aa1c4a4465

  • SHA256

    724fb7b224b8adf2ad5085a6c1b8d8d626b0a741cce61f99e74f6d492405f9ec

  • SHA512

    5797aa5a301c643ed970182df607d4b038ad5b4fb9a0a6999da69d11ff53d0ff5f424ec4e5f1aee6745cb4996f1866000fca451b4da0138653ce29569334376c

  • SSDEEP

    12288:0uhZPzSthNZsfbYxUGPZ8A4kd6GbG/L684yV3Av5QBwx4fURxuga:6EGTLSfURxJa

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2