Extracted

• • Target

    JaffaCakes118_0589f488884e684b7e194634694eb8e0

  • Size

    741KB

  • MD5

    0589f488884e684b7e194634694eb8e0

  • SHA1

    44a67a66d15797dcb93503e81d92884718b45060

  • SHA256

    6eb28c0f61ea9e205769d8845b8c5ca110d65029c7cc6d5d7641d79bb330256d

  • SHA512

    ed39e9ae2534cc5f4764424b15395aa231d59f5b403942e3483e28f357513d74f4aa09a3e345b9dba5543144a5aead78e63a0e6562edb240ad866190e17901e0

  • SSDEEP

    12288:kJy1Nao6610xOuSpZ1zs2Gt3ME18w4YoTOKCYvuqtelaf72SgReOJaoAcZf1ZZpn:keao91ekZ1zs2kh18wjsOKnilaTxOJBH

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupxvmprotect

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2