Extracted

• • Target

    JaffaCakes118_19991ebe4ea55953eabdd5a2f64b64e3

  • Size

    428KB

  • MD5

    19991ebe4ea55953eabdd5a2f64b64e3

  • SHA1

    e2dab66807a05b1783749ea72dabad5f7df0e076

  • SHA256

    ef4dee877ce638a315614b9471a53f629998895ac070e4e8788d962d184d91d4

  • SHA512

    66e66cfca4974fb983384caa0d251e2cfb8308c9a9ba55c11e2d44fcee23398bae904f7385a3cdd414e6980ccde19743fa5da5e1a10659c823639e0579b18e1b

  • SSDEEP

    6144:QzgT3w0NbqIIN/GjMYF7BxfrSknIwQ1qMqkdU2GF0gyVcTlNQe61YGqj:QlyIAjzpBJSIIwQE0d1Etgv1YGM

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2