Extracted

• • Target

    JaffaCakes118_3b91ebd7a7664310dec4cf48c82bc2b5

  • Size

    468KB

  • MD5

    3b91ebd7a7664310dec4cf48c82bc2b5

  • SHA1

    206813b81df20c0490fea727085ece4de26ac74c

  • SHA256

    337929454b61a9b287f9dd1cca7551f553b3dd097bdb13b5fee44e50e2cd94aa

  • SHA512

    f7a25985a65ae92d7cf33c49fffd811335ceeff5ee5a179f54d23247eb58b91219ebbcc8e90bf214c60559a70d91bd7ef39b9953995cd92e31763e0a22ef883b

  • SSDEEP

    12288:LPHhygWECwps0n7p4328DoxTduuoTDK7HFvjol3wF:L5ygS2sg78OT4uoKW

  Score

  10^/10

  cybergateusersdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2