Extracted

• • Target

    JaffaCakes118_00a60f270bfc881e22698e8ee0f28b87

  • Size

    474KB

  • MD5

    00a60f270bfc881e22698e8ee0f28b87

  • SHA1

    0121f90db85627f8ea785032ba21f6606f303720

  • SHA256

    08771c02efb5b25b28147177ec9ada89ada8f84381811393623a494a5dfbd5a2

  • SHA512

    4c05b77f45557caf6b61e128c2ecc1130f8e05609e82fb932d16036325b54347e1e941a11eded362e4b64bea88c2187a6f749b59c2073860227196b664aab49e

  • SSDEEP

    12288:Vj+cDRCU1NuPkTkzycspXc3oCGbxEw2hPLUp:k+NuPkwycspXYoCrhDUp

  Score

  10^/10

  cybergatefud_a.d.i_aresdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2