Extracted

• • Target

    JaffaCakes118_2df98fca2e8dde082d1b66a69ccfbfd8

  • Size

    400KB

  • MD5

    2df98fca2e8dde082d1b66a69ccfbfd8

  • SHA1

    6e0aff5e192350663011f10cb03de03b7448c1a2

  • SHA256

    604949f835680a1888f88521a2c0b5bcddf5dedb4213011fcee7e36a804dad25

  • SHA512

    0d47930d681c28b2871099585882989ba4f6d7fb2114d8d49132d0dcbbcd065292d7a41c70a16f576f251410f17cd36a21677c5226acef034105e884246f4e39

  • SSDEEP

    12288:Siu/0MP6DD+6xBej3Fy/GBNShlKxoAoS:9rDFBej3Fy/GjelK

  Score

  10^/10

  discoveryupxcybergatethisisfudpersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2