Extracted

• • Target

    JaffaCakes118_09a4d76f19ebde7513e26a2042c821c7

  • Size

    364KB

  • MD5

    09a4d76f19ebde7513e26a2042c821c7

  • SHA1

    becdc70b0bf0d16e3b8642b6f7d50f45b5e9dd97

  • SHA256

    ae70864429e3d72ec009a8de99d444db002e5fcb1d8f7507cd71b27d8463d125

  • SHA512

    160f0a2845390bed5485fedbab7a23dcc85d4a21e674b162328dedbc8614de1afc4b39cb0c07a6024960f1cab79ba9f185d1ea8170d0c9fbff1bb97c0f42f275

  • SSDEEP

    6144:SvXIkSFlhbDeB+so5E4HydWJMomNfGo4M071hHPKnlyQmDkyieWt9tcDS:KXGZWQvEccJomNuJCnlySyieWZD

  Score

  10^/10

  cybergatedjookbadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2