Extracted

• • Target

    JaffaCakes118_1469a89364d6c3471abe2e685afd38dc

  • Size

    320KB

  • MD5

    1469a89364d6c3471abe2e685afd38dc

  • SHA1

    80e0032c42f1b54cecbf671d60d1f07dc768c434

  • SHA256

    31de6a7cd0a93db1e2ae714ca8c841a2ec7b300d245faad62e4ffc2841908b15

  • SHA512

    20846b7dfbd727b405e71db89d2f82b423b0f81be055b79532edf5f25448ee79ae00266b6e0054083fa10b9a4f0d729d1ed0e7fc207f9eb36a776fe64b56e0ae

  • SSDEEP

    6144:wFefyCATNK59AIGrnNjFwKLZqrMzrhB/NQw4tR4J0+nkrfHr:WGyCQ8AIGJiKbhB/Zu+ner

  Score

  10^/10

  discoverycybergatedefautpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2