Extracted

• • Target

    JaffaCakes118_19a3ca0ec1be5253d76d325b281bdcd6

  • Size

    304KB

  • MD5

    19a3ca0ec1be5253d76d325b281bdcd6

  • SHA1

    8c52da4344f8c843b3c202db212693b3109e7e24

  • SHA256

    d30f471a162003831830695f9241ed21c66618b0bf2f2a83270de50e7079eb97

  • SHA512

    562ce5318218228738bfae3243c58e359a87aa9977a4fcca06f41d203ebc9771ddc9dc38a7be6064bb6ce8d99ec6b07d11f23d25fdf5a7707b828af29a0e81d7

  • SSDEEP

    6144:IbSv9HS/MOlT18ErDkxIb3eQ7ylHu8J9BP5Dgeyq1IiStlv:8oHUMOJB3kx03eQ7yYA9BhUHqcx

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2