Extracted

• • Target

    JaffaCakes118_79926ac1886dccd96e70f5dd8b9c1eaf

  • Size

    572KB

  • MD5

    79926ac1886dccd96e70f5dd8b9c1eaf

  • SHA1

    c335d5467bea19b582a896ab336d547e62184f55

  • SHA256

    aedd2dd9535f2d33808c96ad01e6a9b67752565fc513fcac7ec6136f5abdb607

  • SHA512

    c020f9975aca8f69f96f6e6b17f41d0b9767dee4340fd37f058854629b9a0bc69a198a34988f8223b3ef6b5930fcc24b15bffe7f1aa90090ffe4891286130a5c

  • SSDEEP

    12288:jaTFTmzawPSKKcD5+4K5HJOoQtdG/tRK1u7UuVxg7:eTFfw64D44KhJOoQKo1u7nVx

  Score

  10^/10

  cybergatezombiediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2