Extracted

• • Target

    JaffaCakes118_9bbabc11e3236c709ded7c2b331b4e47

  • Size

    569KB

  • MD5

    9bbabc11e3236c709ded7c2b331b4e47

  • SHA1

    09072fcfa3e62c0757c3b1569ccc69230d7c4502

  • SHA256

    236badd8c379c73f008800000dff278db7460e50815c54895db12911e84541f4

  • SHA512

    cf9c818f31a7b72624e9ce0a28e915dfd4cdb40b9bd1de033f87da0e550c073594cbbef49b402f823df92d5dc2cddf74d91627f13035156eb7d8076e4fce7a9d

  • SSDEEP

    12288:9DWH+VoAzCMVv1IK+mLI8LKwei+/cKdI6RUM+F6eCQ9HxNtBI:W+6AeuIXmLI8FeivK26J6CuP

  Score

  10^/10

  cybergatethelegenddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2