Extracted

• • Target

    JaffaCakes118_3edd2968e51af5adf9eb422aa0814f9e

  • Size

    2.7MB

  • MD5

    3edd2968e51af5adf9eb422aa0814f9e

  • SHA1

    8d89dc20b984879595e7bbf8f6d8a5c601b1c6f4

  • SHA256

    2666e4635c4fc3c17f50f5fcb8fc88500971a767f9a21715a343bb6f516136d6

  • SHA512

    bf284a601beb969c8430a5b80849d16c0490009e889b49a5203299924f54de3d59cb621f4738f4d6c3e9f6cf08f9299c907d7efebcd9e1c3f2822f71dc7f65e8

  • SSDEEP

    49152:P43oIyPLXyh0yt5ssrmAfAyM59RGqUKhs5eRYYOwGJxlndmGqjB2FxV1bW:P43wPL4P0sr9djKhs5txx1dmL92FxV1y

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2