Extracted

• • Target

    JaffaCakes118_3584eea2ee58d33e583b020fdad0ca80

  • Size

    304KB

  • MD5

    3584eea2ee58d33e583b020fdad0ca80

  • SHA1

    080ce86582e0f46da36d0b7723e25c5d30c8b7aa

  • SHA256

    589bbdf81e78c308079f4af1ce76e3480b8194eea4d6306ab33f4779b6f2cc2f

  • SHA512

    58bee8c5122fd7c51c50dfe56f09efb5f6d3cf8e35453bffabfcd756c19c225967cc0d5d9122efa5ac7d12c9c6774aa5f25c03f5a5de3b61f790325ffcaad09d

  • SSDEEP

    6144:ChQVWE9/I5oG+unnz7MUry8dmt7jxG/+6IAXlbC:COlVIpnMA8xG/53XlbC

  Score

  10^/10

  discoverycybergategh0st____mand0persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2