Extracted

• • Target

    JaffaCakes118_1da5fba3baad83f70f819290168f5639

  • Size

    982KB

  • MD5

    1da5fba3baad83f70f819290168f5639

  • SHA1

    98a329737ecda5237ea91877ebdeb485c0f9ebfa

  • SHA256

    50cf157ee1eb4d51a3ef4fe0b490a8a69624910b4aba64b55b18da63fc45d942

  • SHA512

    6ee812b1f8a87ab764cdb8c8a8f7c80156bb4721496eb512d96d3e2bb01c55b410cc92901af0e7763d97bb70afcf3b91071883517bf7161c71697fcd8c9c87f9

  • SSDEEP

    24576:XJaqe627s+M/B/yt99YhlgDjeIt5VQ1TJcrFJYFp:I6p+WQ796lgVtfe2Yp

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2