Extracted

• • Target

    JaffaCakes118_283f771abe33b3a2122d759a2c6b0b5f

  • Size

    344KB

  • MD5

    283f771abe33b3a2122d759a2c6b0b5f

  • SHA1

    9933d40c3c09f06a1f1ba8298f4d2e2d71e545d1

  • SHA256

    5c24e129ec7dfa01b1d21ed48bc981ea4200b91b1cc5350cc244508f7aac6bd0

  • SHA512

    13e2fd79f4521951cdf088156a0e56d7972d6927648872911105e8118d8803a7fe272014958dacf549fc1ada9962ea07f6ea1b918a063e9b9676824bc5b7d288

  • SSDEEP

    6144:EoIChTY6YDH5QmIZvT8Px5FpTbvwTd++9ziENTNDzj/H9X6ZeIJfRkvNyCuHj7Oo:EoIC5Y6YDH5Qm0U1TjwTX5iEN5Tlee3U

  Score

  10^/10

  cybergatefuck3rdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2