Extracted

• • Target

    JaffaCakes118_13945c3352dd447f3da70cf25a368a7b

  • Size

    1.0MB

  • MD5

    13945c3352dd447f3da70cf25a368a7b

  • SHA1

    8ae9255a87fad77ef72dbe6889b667cd00ea0f93

  • SHA256

    f6ce3f9544d9d9999a154b08260730672fdecaf6ae6972142e3b8c2360cc4f9d

  • SHA512

    2bb8877a3d8741e594158c16619fbcca4a90d8e6a7ac8d60fd10b3710c3951ad33912794543498b65278c181fd3316b374cf9a241ce4a93def2c4047b2f112eb

  • SSDEEP

    24576:w3sYx8PaJ9EbUgcSw9in6xmsZORmQmE8D+:4x7P0UgNw9Q6xmTBCD+

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2