Extracted

• • Target

    JaffaCakes118_2ce0a2e5fbdf3bc5ffd28f09f5e2c171

  • Size

    868KB

  • MD5

    2ce0a2e5fbdf3bc5ffd28f09f5e2c171

  • SHA1

    c3475a7e1bacbe14f6cf97dbccdf31b4dd623433

  • SHA256

    42dad031b697008f4395b0e4b2d52727bf6fe86004435b7a075d7d991fac789d

  • SHA512

    83e0c3a0aa40ac3e035dc5eed638faf83fc7d6d2219bf53a67e1a9a19a203e6d90d2f39e3a2dd5aafe4d3e41df543a5d6992881e44fe45f853cdde99fd84aea1

  • SSDEEP

    24576:PKFOnnnnuYsInnnnnED+x1042CDbGuiJ5p4vf6KqHurTtzUkc8IxLLP:cMGPJ5jKqGqxLL

  Score

  10^/10

  cybergatemasterdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2