Extracted

• • Target

    JaffaCakes118_22c50491e5a14b39804469a812c9b285

  • Size

    383KB

  • MD5

    22c50491e5a14b39804469a812c9b285

  • SHA1

    5042192fdaec79cc375c2048bfd0ec17f6b06047

  • SHA256

    a3e6df557fb5207256cb4b6daba90a6591e3c3eb64b253a28b5d1c152a7e5f05

  • SHA512

    416e24066e6670858c7fe520b57826756875507b182ee04014d34356faac661d19008a21071206f09b1439633c03c0ef85bb13ed33f2201da5c8616cf73cabc0

  • SSDEEP

    6144:qQbdsPOX1XVEtuYuDaPTNXlqPK+2c4VZGceNAq2K/Ooo0imRX9b3EXFIyDoUgwVE:7JX1XVEt3AiTNXl5HcSeuRo1iuXVE1Ro

  Score

  10^/10

  cybergatecodeddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2