Extracted

• • Target

    JaffaCakes118_3d9f3f7f74f2bcf873be739fc2f81578

  • Size

    305KB

  • MD5

    3d9f3f7f74f2bcf873be739fc2f81578

  • SHA1

    1c95b8c739eb7f6b417f04d4050a4b9856f6bae5

  • SHA256

    a713682b411e821e843c60d489d4b4ebad29374e143bb3e1810749e5ed34c770

  • SHA512

    94a14fb0d7151dd30b6a5e6d53f7008195fa8ba297bcf7a9f8a53c143877555bad079c51348064522590b223bd7d4322770e2540eb57f184126da3f67dbf4fb6

  • SSDEEP

    6144:wFID9vbqd2Rw/4XFzaEX/NxigJCQI2pIKNVL:SID9jW2Rw/4XhXlxigJu0V

  Score

  10^/10

  cybergatetargetdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2