Extracted

• • Target

    JaffaCakes118_0df23e30c2dbfb9b264b55f6cdda34bf

  • Size

    908KB

  • MD5

    0df23e30c2dbfb9b264b55f6cdda34bf

  • SHA1

    23dd1eea9f8da9355246545c304c20b983004ba7

  • SHA256

    8cab8881167e71de50491a517c315ee35fd5a28f7209dfba5178af01c45367a8

  • SHA512

    e58620b7251c561a58a75ad373b5d3475b9b7c663737224da411ef6c338700f59160e7823f36caabd9e2fb3059c83221ce15261d41a996d253755a0dd13f15dd

  • SSDEEP

    12288:YGo7YNQg2YcKify3iTntxrr0cuUPnIpVwDIX9cgtWb26nGBMY7+4ET8laZ/lt5TX:YPwQrsiK3Sr0ckHCb2ViYS4G8Int5TX

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2