Extracted

• • Target

    JaffaCakes118_19b6a20397558e2ef94f5241e4943096

  • Size

    556KB

  • MD5

    19b6a20397558e2ef94f5241e4943096

  • SHA1

    b328d793a1e586c82e7e61ca78c0525757f1a3ff

  • SHA256

    6cc6c8b2b6f9686420d28a37ca90c28ad293fa3ecb8ed04b6c00b485857c86f3

  • SHA512

    e9a22ff9d57218c9bb92a2187fbfba05b9b1fe9fdcf6cd9bc2bf3da3922a9c93fd0f56956a2fb5f6a23543333995d48918fc542609591d02faecce158995c3df

  • SSDEEP

    12288:WCch2uFb6mvmM8GmXoxPh54pQ1QTvHz6yYEcUl6oKhG+xS6Y9Dg1DF:vch2uFemvcTfzlovxH

  Score

  10^/10

  cybergatevictimesdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2