Extracted

• • Target

    JaffaCakes118_0b2f346367c8ae13d5f3eb2431f293ca

  • Size

    365KB

  • MD5

    0b2f346367c8ae13d5f3eb2431f293ca

  • SHA1

    2710c5f241eb7a30b20c8390122dafb6b6f9523c

  • SHA256

    98877addf206de59e375a2c09ccebcdf5d3610b87fa7d4a6b0a5acbd5c39dec6

  • SHA512

    1642906a00ce0140122074a0811c39961a09398f9a67ce6a27f0de6e51099536e3af986b06c12bd525fe4a1dc529dbdbe3e9665bb31772a1b053a065d9e300de

  • SSDEEP

    6144:k7sdufcNtrb2elWf/DTu+CMu3Bc2lrfl5Slrw33Z7cepVP2+aqZciYjtpOGepSmp:DRNR2eleDT/CMiBflrfl5Slr6321qZca

  Score

  10^/10

  cybergatejahrawediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2