Extracted

• • Target

    JaffaCakes118_1cbe05676ea7195b640c039ff4547eba

  • Size

    344KB

  • MD5

    1cbe05676ea7195b640c039ff4547eba

  • SHA1

    5a4a7c7dad1a9de4a91f7215ed29ccc05bcb8a16

  • SHA256

    dad1f4922c7a805db7ca1f418e6eff89ac933df01c2ee02e8f4e03ec16afeef4

  • SHA512

    f13cad235ffe63a31725cdb1050cb08dda00ef6e979414bd5bf3cfc2a00ebf28a03a218d294465e1cfe5d816ca949c68fd3410c59e810d48079bf61b08e2bb13

  • SSDEEP

    6144:bAbUG0xsNmvi3Va+EcU3Iw1J5Gfn2AMYIEUZuqSBt4Zg7FOUzLepnPg2I:cAG4cmKLCb5YXMJaF5ipnPQ

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2