Extracted

• • Target

    JaffaCakes118_3d8f9b2af7b3c1ac2e491b3cc7e72e92

  • Size

    360KB

  • MD5

    3d8f9b2af7b3c1ac2e491b3cc7e72e92

  • SHA1

    6a9a1e77d5caa672bda9fcc7a4ec0f75f4eb1c4b

  • SHA256

    c0e97c8e14c51b1c506d0705c89b78432260001c9fba3dc49721312fdcd11a70

  • SHA512

    f3f9e51c811c057aab3ee21da10a937c8cba39f2a824ad1ad9f52394d6002c5cd56c489c80f8cc55e0da890db08491eea7b46d1ad7397e751205e417abef19b7

  • SSDEEP

    6144:TbTgoTZyxqg9nbjtDf1IOLJLhgs5LGNNNldctp72DrUGi4eAB9MO9HN:TzpGbJTFpLAnlwBfJCHN

  Score

  10^/10

  cybergate[email protected]discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2