Extracted

• • Target

    JaffaCakes118_12a3000ecd4bfbeaf03edfd63137d6f8

  • Size

    323KB

  • MD5

    12a3000ecd4bfbeaf03edfd63137d6f8

  • SHA1

    91b2fb3532e99bafb2517c526c1e47c7d92ad735

  • SHA256

    4c5eae98a9ac84191addcfe2d0eb23ae4705d12d3c732c0cc7e8ac16f3276754

  • SHA512

    17be0b1e469e7fb45c3f1fed2e5bf529509734bae29051cec3b3a3d1cfecb770147b1a00b99a29802c64ea442cb0e9c6518b9586ff2653a36c931b377e622d37

  • SSDEEP

    6144:r/feJ2O2px3kVz1pvUEBC23gRU2e8WHmQSx+f6de3FOfjYrTnev9sqI8gD:r/fe6pS11pv7zGxo6cLrTnev9sqGD

  Score

  10^/10

  cybergate1886_v4discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2