Extracted

• • Target

    JaffaCakes118_211242bb94efb39382414924adace07a

  • Size

    471KB

  • MD5

    211242bb94efb39382414924adace07a

  • SHA1

    8d01e27984019db814f133090db5854ca539e53d

  • SHA256

    dd1f4b16f2068020aa19282526f5c69f06b76dfb7f2cb4e006c58cdc770040bd

  • SHA512

    f1b736c50f88ba9302fc819a16b1ecc7ec17d6dee2b5a7ef4a3383ee79c2c572d3bea4c1b7de3106712d06a0cceb7d265e2be557da79164bc0730c5f5037f71e

  • SSDEEP

    12288:0czJJhqrVPY40/7ueQj4sC/0nbfZNtSpwzte4:0czJKVA40KJ7njZNlzo4

  Score

  10^/10

  cybergate2010discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2