Extracted

• • Target

    JaffaCakes118_10fd51a2fddeefb093578f1a01650174

  • Size

    919KB

  • MD5

    10fd51a2fddeefb093578f1a01650174

  • SHA1

    02e4ab95d1c1dd0a02fa2f5d1df58cd4e56d184a

  • SHA256

    791d940bc16a7e5c542a9c3978d29a1318d14045aa95b63b2ae7bf304ef01e60

  • SHA512

    6d6991781f0a855eb32cf0fb5bbffd356a62c3fae547bd3c7f5f2fe8b52a68442c473e726d85ff8f0f5e3e7784969d8ffd3bdc814261778b89f289e7fa5cf20f

  • SSDEEP

    24576:n4ABz1P24wvG1XhWConP+3j+sAMBY4N7CRl:nvh6vYOniAM+D

  Score

  10^/10

  discoverycybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2