Extracted

• • Target

    JaffaCakes118_0451811ad573555888dcd3d88880feba

  • Size

    560KB

  • MD5

    0451811ad573555888dcd3d88880feba

  • SHA1

    e0fe0beab2ee35807efd4b9cfa6ee34ff97f9c14

  • SHA256

    e8b445c30cc5da74b293034363af6d46daa53f394b0769c2c29f3149611738dc

  • SHA512

    f96256e75b5ade62618b4ebde8018d6ffdc7beefc0dd1aefa37b00c1dc969801686e28e82bec0b228f7e6460cabd3659dbdbe8644bd7560f738a875f177f8828

  • SSDEEP

    6144:SbTrLCM/Y6RJCfSN30TCs2r87dB4vHXm8aGbYnYMt9VyroRD/m+kBkwL:qDNYfk9D8D4vHZbe/Vy8D/cB9

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2