Extracted

• • Target

    JaffaCakes118_06f7109196167d0fdcd66ba4df396bc9

  • Size

    553KB

  • MD5

    06f7109196167d0fdcd66ba4df396bc9

  • SHA1

    edc12dd8b5fbf6d3cf85b3dcc369c2fd96f1d76f

  • SHA256

    49b98d042dd9cb333bb064059b07fe5a645554bf48f2a7da6f220e4b7c49f7b7

  • SHA512

    1af4cd631bdfa83195499464b9bec187f782d6cd5efc91127f6465f3d708723bf6e716954822ebe88a256ab077dfd83d67bb261e3821d62e88da222e6b55a022

  • SSDEEP

    6144:CZfTNSFKY+F0fHpbV0NqG+0Zo0i16t1V5UNG6x1ZCcjXlyBSaZYmO1ua:CZfOVJmo0i1IN8bLZBkSaqmpa

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2