Extracted

• • Target

    JaffaCakes118_081f84018a72315b1b928c7be3d19bce

  • Size

    337KB

  • MD5

    081f84018a72315b1b928c7be3d19bce

  • SHA1

    0b63505af76ad9ff90c366c407bd470ad25f7725

  • SHA256

    54157080edfb6c1b550da11463fa8d8df0c4e9ffeb1c09b7a0d0bbeacd536d1c

  • SHA512

    db967cfe2c7538364404c2ca25be968f5f2e5ec8d0c696c7bfda5ba60e69efdbf5acebe9d8f35d588aaa8f567e34bcd2948b9e44246111a0e513e263132f2412

  • SSDEEP

    6144:fDiW64CVM4JP+tSE3vLFz+7oJ20Zi4qhAI:fDiW64CVM4ctnTN+7iFJqhA

  Score

  10^/10

  cybergatenew--xxxxdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2