Extracted

• • Target

    JaffaCakes118_f0f3e15b5d97b6e347227bf1fb3747a4

  • Size

    327KB

  • MD5

    f0f3e15b5d97b6e347227bf1fb3747a4

  • SHA1

    1a71a32c768cf7a86471d2cc548bc2213444536f

  • SHA256

    1a32f3146b117e7ab445810efd8f8e25fbe00422e90983dfb4e4b77b7d3eecd5

  • SHA512

    3e98bbba85cd3d28adf00834a6ab03a84d2c4191a0bfe7147fdf73fd9ec6d6ec22e1e524d2a6f88a50f40b34b786a7b1a6f109f1d4b69b9ce2a3c758f9a05740

  • SSDEEP

    6144:oxOZnNwTr6dFQD3Y4ejVO1v1b8QGw2gwasrmmWqfdxAZUAcSq1UDeAaNkU1gzFJz:oxOZQWd9qNaw2gwNWUPAZrvLs1gJJxIK

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2