Extracted

• • Target

    JaffaCakes118_123e851318afb8cf97dc6eb227d25750

  • Size

    648KB

  • MD5

    123e851318afb8cf97dc6eb227d25750

  • SHA1

    a2f14f81fa741c8d1aab4eef321ee323272f8ae4

  • SHA256

    ad60f4a51df96b3e90244f59c944e74f58969689b8a1304b4efa329ce38448bc

  • SHA512

    508793424e0e1106d991b1712bd226784d07f38228ab746ab51638d52fa08a9b1fe549321236d917a58a5fa4f5e8ae177487bd870c94ac1596aed0fa9d202ad2

  • SSDEEP

    12288:XZZObFACpbBRAehW/2alPfudoeVHT9uDtOzdVcBp071cZbEQs7b13IG0tK3h:JglBX4ZP/KHT9uDtOzdVcsybE737

  Score

  10^/10

  cybergatekusursuzdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2