Extracted

• • Target

    JaffaCakes118_25e98d702be0b342ecc1c65d11454ab7

  • Size

    317KB

  • MD5

    25e98d702be0b342ecc1c65d11454ab7

  • SHA1

    c0439c6d6260123cd526e16912bf84002756e09d

  • SHA256

    c37b92814b6e1fcbdd18067cd8ece92c817129798d2ca5782dba657494acd1f7

  • SHA512

    508846ed9168917807cfd59fc6de3dd5b1db52036cdb45cc01e4dc35ace29308d07ba089a94c696e66b46b064254e1cb3e25ce02807d6cf5e058d19aa18d9a77

  • SSDEEP

    6144:Z43Aq4DjOuawcNs5zADQ521FdfkiAaMKGaVon27M0JpIKGXh6guw5+J6HWzu/X:63Aq4/OuawcOBqGcfrMKl9g8IKGkhw5j

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2