Extracted

• • Target

    JaffaCakes118_d19c6f63f83ed90c6d55221e687d3f85

  • Size

    687KB

  • MD5

    d19c6f63f83ed90c6d55221e687d3f85

  • SHA1

    c785358b97172243cee1a56bb81fc826e098966b

  • SHA256

    4de06536637e0eb796dcb51816126580ae17e0f68532e3460a7c7049884c9d67

  • SHA512

    9e510ce576429784f1a777dd4b8f328ad2d2dceaa8b693af94391c39c4f5a1c61c5be1e4ae9d92f2d1035d84314dc1657ab3a7f2272de3c586c1955a422140ff

  • SSDEEP

    12288:gw9pA/m3AzcJRj0DDZPLeAvxlKFg++ijkQm6lwe/ig37/QMtMJAl:gmiwsDDBjvxSg++iQQm6l3J37/QMt4O

  Score

  10^/10

  cybergatetotaldiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2