Extracted

• • Target

    JaffaCakes118_3dc558515029fc90c032e8c87182167a

  • Size

    408KB

  • MD5

    3dc558515029fc90c032e8c87182167a

  • SHA1

    66a22ac69adeb8e2179818a309eca4456102c978

  • SHA256

    16ffcdc5ef50396da070f16e3a361cdcca08797678c4a9f757b9840f20cf6bfe

  • SHA512

    3b2649b49cf2b71c1e60b54d15f427b4e6f04d9317db25d10b2e1e303825abf8b65df507383784d80249848119896e2dd47aecc7f6630376f5c724cc2dcc5026

  • SSDEEP

    12288:p2lPG1YjolC7IuOgooXcAhlKRabki1qTozd:MjolC7IsooXcSrqczd

  Score

  10^/10

  cybergatekurbandiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2