Extracted

• • Target

    JaffaCakes118_1304b57f7c35fe8d6cbadf11b094cf6e

  • Size

    318KB

  • MD5

    1304b57f7c35fe8d6cbadf11b094cf6e

  • SHA1

    913cc39a25e476a33fa2b4ee31df0e7ba4ff4c09

  • SHA256

    2f47f37edd742ec8bab03150d5fc5a942a0027df8265ec71905c9907bff52737

  • SHA512

    eb16ee3f02883fcf59b05aa1b15492fcda92b15aaa44a2d6c2ec62dbc5f3631a3dfbe5c301078177abf9b6d1db0002f8c00db42372a6fccbac4ba7df41cc39ef

  • SSDEEP

    6144:/bZk5rQ1/+8ER0BhorPTE5b7rfykjcPJiK3VZq8j8Uqierv:/bu5rq28ER00rPAiP4K3VZSAerv

  Score

  10^/10

  discoverycybergateîçñæææææææææææææææýpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2