Extracted

• • Target

    JaffaCakes118_19fde4dba1143d56b70742424458d3f9

  • Size

    2.1MB

  • MD5

    19fde4dba1143d56b70742424458d3f9

  • SHA1

    7bde960fe865e076d2921335d08c84de06891b71

  • SHA256

    c2d63915a0d0874c77e4f519b34489077947a4ec879b60f947a77ca2d89cbf7d

  • SHA512

    9d1469357186bbb178881fde091152c4bf9dd9512f6fddf2a2993ea312f479331c984efac03a50f24d9e94de5a95c472a158eb9a4d97e1748cc49ed0e38edcda

  • SSDEEP

    49152:mWlhadsLGfD3amcLFD739VuIGu4U4cPlLQKSYgPB/ZxYrJ/GFh:bhaz3amcLtu8zNYPBx+1/GFh

  Score

  10^/10

  cybergatefuu-mortalittediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2