Extracted

• • Target

    JaffaCakes118_05b5ed5260fcdeb4aed9d7ee9ee13fad

  • Size

    569KB

  • MD5

    05b5ed5260fcdeb4aed9d7ee9ee13fad

  • SHA1

    282c3d4b44271dc278dcb74617b65b4af2772766

  • SHA256

    f342581c5bc1aa518019d769103099f75f1c8ed94e6c8831c3d4f3e083ad1c24

  • SHA512

    bfff9c893bd2cec4c710609b5493a138cfe53625d2b29bd30c51f99d8019d613b390de73cfa51c727355b287690e89cc4836d78ebc588424d9cc0f56a5b6429e

  • SSDEEP

    12288:HAIiDh2kj4UFImiuoi5FPeAtpVxagMU/plruchDofAPF:3k2kj4UFINuosnNvfucVof+F

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2