Extracted

• • Target

    JaffaCakes118_14d4ca59e4a86df8ea30a0bcdb8075ff

  • Size

    338KB

  • MD5

    14d4ca59e4a86df8ea30a0bcdb8075ff

  • SHA1

    00afc5f85944251f5da4cd18315e41dc38e244e8

  • SHA256

    e201abf5cd992088e9c3306a26a61d6fff2e9401a81264bb121f1eaf9e7bcdf6

  • SHA512

    cc79af618c592553ce0e543ecefc1ec49ae60bb706c532d4f3a87af61dfafa63dd706231246bcc3d4ed4ae2d37e87510826cb4db6e0f3dc843287e873d603bd4

  • SSDEEP

    6144:0SmpbR7+70EUg5ach8Sv8+2FkjOU9BwpO5PETlT4yIUzLrkmnldpZLzNU:XmpbR7+70EDVh828+2wgd4RKr9Zze

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2