Extracted

• • Target

    JaffaCakes118_12008b8448c7c4b3b53aa1ff00f03d97

  • Size

    400KB

  • MD5

    12008b8448c7c4b3b53aa1ff00f03d97

  • SHA1

    f9b494424fabfbdf4e583547ef5d120e8f0dd5d0

  • SHA256

    98b897fda4db8b917813c907280d4f4e021c45a930733586b9a3353a2b013795

  • SHA512

    2bb4af09931db6db8b30a4badb307ad9417b0667ca8e280f77dea37505f212fae9e052437f490b5cfd8c64daf3752d805df2629838b5b065c30211df5b890714

  • SSDEEP

    6144:xYsp/Pd9ANO+RWApIA1zQTOWE4LmpA485h7WFz0MCZe2mIXR4:1Jd9GO+RtIt94c+0MCZbmSW

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2