Extracted

• • Target

    JaffaCakes118_1a1691d195df42bbc703d2b1138666ea

  • Size

    298KB

  • MD5

    1a1691d195df42bbc703d2b1138666ea

  • SHA1

    f613b477e06128d8372ba5be4ef9295d41a67fdd

  • SHA256

    d3ae4b489ab30be0c5f236ff2952bdb57d7f7f7fafa6f73d259335eefd2f696e

  • SHA512

    c33dfe124260ab75b1335674c04ca5d5902b847519809ffb2853e4ef5b7a990cdd8590c60d423df7679bc73e04b293c66dc2e0120d30eae13d330ab43b6eef6c

  • SSDEEP

    6144:qcC3YGES8VIDTkzyUMscchEaywpq1nftOz65994b:jeTES8VQUy9sXEayLfgb

  Score

  10^/10

  cybergate%%%victima%%%discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2