Extracted

• • Target

    JaffaCakes118_3237a5cc538aa92dd6785b59c8fe492d

  • Size

    449KB

  • MD5

    3237a5cc538aa92dd6785b59c8fe492d

  • SHA1

    973eaa5d19be0ac453605e07e7f60b9f877fe595

  • SHA256

    602d7aa01ddee6d9c66f992bb94fcd105d01aae41ce9da34b47d49d6e547f5e2

  • SHA512

    58184b3d652a6e06d0d46d2d36789bbd173642cc97fa0044bf1baec8b08ec7acd540c43257812f452f0f53197c236ec1398b4245e23a52588c058e2bf083a2aa

  • SSDEEP

    12288:YbLdUehU1D1HfBdCCwlA14EA+cLk9YY9ABkGFL2qc:4hU1D1H3RjxL9YY9UkGFqq

  Score

  10^/10

  cybergatecgatediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2