Extracted

• • Target

    JaffaCakes118_1c2cbce4a270a90828377b0aa5b1c393

  • Size

    396KB

  • MD5

    1c2cbce4a270a90828377b0aa5b1c393

  • SHA1

    d93461860f027f0b1d724e9e42d407e20ab4a76d

  • SHA256

    329b195ae374b0d6f4e4c49058afbdf5d3d3ed7db97f4b7373ea6c76fe21f346

  • SHA512

    c0d43194962041f15670aed8264ec0b6fdbb842a4fa0dcbe5b3295a95743d7231abecf9245fc76e41c1deee6d048a8021418cbbb38fd9417012f223638c1d47d

  • SSDEEP

    6144:OeUXTSjiyrVQLW3vcN8PBIn1M4AWU/VstLbpPR6g9J0ERUpR/s25Up0Gu:OHXTSjiMGUy8PR4oGVpRzqER8025UCj

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2