Extracted

• • Target

    JaffaCakes118_1196827547a13d6ed0516f9596e2d0ce

  • Size

    394KB

  • MD5

    1196827547a13d6ed0516f9596e2d0ce

  • SHA1

    c2cea3e3a5093e8b2c38d936d57d78549cf746b7

  • SHA256

    13cd74ad708fd6de4c020f5917493206efa2e8f3908a558d0c6792078930f865

  • SHA512

    c1f0f2ce5f3e6433d555824c2cc27e15dd0f746fe304161095dabb2b442f3a82747623c8f50e06df4d12d4559ea11c57033a700b855aa672c903ef65ed894bcf

  • SSDEEP

    12288:7fx/0O11fcKxHwQ/55PIY9g5ohylRzKzJelRF:7WObE2HwQn93hylQJefF

  Score

  10^/10

  discoverycybergateuserspersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2