Extracted

• • Target

    JaffaCakes118_068531f261219bacb78231480ba5fab4

  • Size

    376KB

  • MD5

    068531f261219bacb78231480ba5fab4

  • SHA1

    0f972d8ecc31928cc4550052ccc3adda2aaa2994

  • SHA256

    133f936c53f9f8236cf746b920d98da6b8da6348838395c481cfb3d1a42b4aa8

  • SHA512

    7f1b8bcabc5c54c60f47fc4fe1ba3b98657c50aed94408d8f8321f6b9d42402c0a5e48fc918c490d3dfd5f92bd07b8b6d14ea17521d82de0e075a8ecf37a8bb3

  • SSDEEP

    6144:9e6nKPbhX9Hzwe407cMnEcFFRMNOHLxcn3rB+GA9qs8wRPa6MW1R:jnKPbhxzw7stJFsOr2n3r/SdMGR

  Score

  10^/10

  cybergatelinuxdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2