Extracted

• • Target

    JaffaCakes118_9338398f58a68247ba6526d4a04ac102

  • Size

    645KB

  • MD5

    9338398f58a68247ba6526d4a04ac102

  • SHA1

    2c2cb2895bd23bd40f6ab94b09a5c18bebba395b

  • SHA256

    6a33c6aff2e98b5d3cade098dd576c4d7100fb11be48c0d6e2079aae386d11db

  • SHA512

    07b178288472e263a5f96d1d55792e5a541df2a41172d015c27298799b58bad765850a8a2658d47d01110601d9a942720fc191f3e48e0ee4d4b64763c810c6c4

  • SSDEEP

    12288:IvhrJ7ago0cQ/Di+CKeBdGzzsifKNqvVcJbeDCdtK8G7Rqb:IvhV7agofQJC12QCoucJbe8K8Gqb

  Score

  10^/10

  cybergatemattdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2