Extracted

• • Target

    JaffaCakes118_1bbaee73c54e321c92cd8e8c3bfaf3c3

  • Size

    342KB

  • MD5

    1bbaee73c54e321c92cd8e8c3bfaf3c3

  • SHA1

    8034e4bc3f95f34bba780dba1c17b7fb4f65f4ca

  • SHA256

    680c3d1e781c8974043ac107f5873e1d6379751e481f699da36a6f1b027b1d99

  • SHA512

    b0dc76a3b533e8e67e3ad1a72097f6154320bd0b20bbbf474602a7e84b975b5d89ba87c2d290ba5e9a6a5f7eafcfb11da9e65f48fd91d74ac534ad7208ace537

  • SSDEEP

    6144:+bK3u+FAdmWxM3TZqQj7oteEeVlWL49C3wKKcggE7vqYSjVw3tFItoWv+m:+bKHAIKM3Fq674OlWLgC3HDCqYYw7IzF

  Score

  10^/10

  cybergatevictimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2