Extracted

• • Target

    JaffaCakes118_2117fb3cce23a1b20c5b6aceaa1b312b

  • Size

    358KB

  • MD5

    2117fb3cce23a1b20c5b6aceaa1b312b

  • SHA1

    0e8d7d5c6c6dd8761c2cc0c75e18b92ee159a18d

  • SHA256

    38f022c3a2d21a2e39a9ed6200bcf3be7e031fef2927983f558d747270ae57a3

  • SHA512

    b7c5fb3ac71e30fc515c5d61a8ad76297c03db714752d785739349ffa99311eb791e85d9f334ba4b92d86cba35317981f4619186c6ea256991493ae30d179034

  • SSDEEP

    6144:cHtDerrOTKGAfVP79nNyoAg45mkEmIkG3Rt8ElUveG2fZYlb2OpnFsBtSOQn:PKTKGAfVhcoxiHnIARzhlbZsBtSb

  Score

  10^/10

  cybergatecagaodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2