Extracted

• • Target

    JaffaCakes118_bfcf3ab1f8580d01f39f88cd252f63b3

  • Size

    425KB

  • MD5

    bfcf3ab1f8580d01f39f88cd252f63b3

  • SHA1

    65e81916ac4c3377f1bd445857a5c15f6c98c455

  • SHA256

    75643e31dc8e898bdd2e7640f64d358571ca7a65b2f5ccce29d7c7e7a3f952a8

  • SHA512

    2ca38dc8d9143f9c13af055ab822254bac1d7449e61725fbfdb80dd6d21b71edb4405b557676f8aa0afac6af637ff0f51c194954278fb260f135dc422b6d13dc

  • SSDEEP

    6144:x1vuMey/YGOIRKw6Vc+7TDlrdsrDcd29bv2fno6P0jx1cKo6RfchUvFWYf:3e46lciBd+cMJx6P0/cOchuWC

  Score

  10^/10

  cybergatejdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2