Extracted

• • Target

    JaffaCakes118_10febe63d2b69bff2d5580c217d288fb

  • Size

    1.0MB

  • MD5

    10febe63d2b69bff2d5580c217d288fb

  • SHA1

    e06bbe328c9c575d36304fb98fc886bf0e17db40

  • SHA256

    49fec817d58b519754260fdae3a5e09d1574003c8c06e02d0f7a18209dfa1c4b

  • SHA512

    ea4e98d1e2c3efec5d9b01f665505abcbfbfba1c6514a8b3c4bfae26ee0e547ccb3e2c89d70c3ad202ffb03b31ff8d4091059cacd843ed2a951cbfe82070a706

  • SSDEEP

    24576:OdV3pZNp5k+AAG6/g7AOlUTpiAbHJqc5GE7qW74OLHIos7/gB:OdV3pZD5DG6/mtwioqcf91TI9jgB

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2