Extracted

• • Target

    JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1

  • Size

    484KB

  • MD5

    db4489c3a14f61dbd6c72f9f07d0ace1

  • SHA1

    7f8e6c096fa8039b8532928f2276a5b019722724

  • SHA256

    2eba27da6360056c02be100d686f7828a2320e6c38bfae483b160919f0b367d5

  • SHA512

    7d84d41d3afb0016a64f765ac23db03bdb329442bf1f4bf81b5d1e5a59267c8f22f6cf2daa829f0449135931a64435e4ec752d9d33ed117c37b41b12b31c0a69

  • SSDEEP

    12288:fKS1m3MwkqKwojlmsagDgkiCxmm6pjlnE4Ids:fKS19gojlogDgTm6pjlnGs

  Score

  10^/10

  cybergate????????discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2