Extracted

• • Target

    JaffaCakes118_b89e36ed5509d279d20015c47c13092f

  • Size

    321KB

  • MD5

    b89e36ed5509d279d20015c47c13092f

  • SHA1

    9777f10ce8baa4b9b3eca340c59c776d8f0436c9

  • SHA256

    4b78e9d6492d9735c230b7488dc63cf17430407e5a51624e99b48f275294c93a

  • SHA512

    1c3449bfe12f988483038e70acd782da8e6cb3216efb8796006bfd5f53fec9eb5cc8414ca00dc00de3dfa59742976bf185a7d859a40e55ca66907a67c6261427

  • SSDEEP

    6144:scgmp6ob63MR1oL40F2gicCctvMevPRQha2MI+TE/b6wYvhtd:scgmp1bM3rMHutUip4bj7YZt

  Score

  10^/10

  cybergategochadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2