Extracted

• • Target

    JaffaCakes118_13e84565dc33e8c7e3019bc35d69a856

  • Size

    503KB

  • MD5

    13e84565dc33e8c7e3019bc35d69a856

  • SHA1

    8b899f80e741e5a8f381b1a4fe7e7bd8148c54e6

  • SHA256

    7348fd8e3460e177c360e972091b870ecbb9d2b12fd2356c92311b765c701257

  • SHA512

    9d745e2142b7f06124fe240e8ff7e4f27c0eaf63092be48d945c77811f1e19fc92e0095f721592f8b331de5c475563f8c0d51d4ff5ff0db834269a705707fe79

  • SSDEEP

    6144:zgqXLAMGmC7FWaWH7hGc4Vw/E+V5JCmPg7F9j35Gw70v7K83XbFXXtZAGHrGqaeq:zbL/GmC7EVG3V0lH3PgT1N7c7dJXHl2p

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2