Extracted

• • Target

    JaffaCakes118_118caa481c43160f458298ba1a007cff

  • Size

    577KB

  • MD5

    118caa481c43160f458298ba1a007cff

  • SHA1

    8e106189db39527aceb8b2f34e9401c3e9d113fb

  • SHA256

    b24be71c41eab0b846d1dadbbc6f14f20fc2f24110b9b1ffb68694d596c5d903

  • SHA512

    99c3511d0224617fd283fef54bea14a8f93fa955277a1a62220a902f08e86e87750f83889d7e57372a4b4a64235f3579f95997ad0e61cae0e6be2aaea04d18ed

  • SSDEEP

    12288:LGxaCUNYp9hXSI/i4S40MR0J1D3u4CNsELRX43n6Wo/M3Hn+0N9BUzD2w2j3RL5M:qxa/ip91mjpoK35+M3RHfL2

  Score

  10^/10

  cybergatebladediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2