Extracted

• • Target

    JaffaCakes118_310199d99e36af16dba79e8bd2823b1d

  • Size

    370KB

  • MD5

    310199d99e36af16dba79e8bd2823b1d

  • SHA1

    9d08369ca58ff628ce7547f6ecbedcf86996faf5

  • SHA256

    c6b866c5ac3f9adf3677b1d987fece1f0f95c3b6e5dbcc5388503750da5c4f4d

  • SHA512

    42bc7252add656871a43e876f9f26f39155cc77e27f0d8eb277bed30199ae78778c9ce7623dc5164618c96615b8fcd8c592ba9248321b37d5e59ec3449346f9b

  • SSDEEP

    6144:HAcAKFkIbLEPD9r9Nga37C8OywStC1ozKX5sZlUxQC1udb37ayEMG:HAcroPF96Mm8HgXGmkdbLaMG

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2