Extracted

• • Target

    JaffaCakes118_03a398b86839f2066b774b623ea26e87

  • Size

    1.4MB

  • MD5

    03a398b86839f2066b774b623ea26e87

  • SHA1

    bedd9eff604a766eebc4db2a6dfa167482b151a4

  • SHA256

    4eb0f49bafa7bbf2262a81bff74263ee50bb442809c233ce1654c330cd181a3c

  • SHA512

    215819ff88a7a191d3c94d81e5428936110557a027f5555253937977023ffe06e722de23c49155a2fa0556f920ed0e796d0ab0decc7bfda77880ebbe61fe0dd2

  • SSDEEP

    24576:IkWAAuqe7qvez601ROq4E/Izsm+jqCX8tf/Vh2VCq2/iYZxUAgANXQ6D/efy8/:I8qvZ0z5Qv+jqa8t1cVCq2aYZeAfTD/U

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2