Extracted

• • Target

    JaffaCakes118_1a588c9f917ba36cf16e340747def2c7

  • Size

    294KB

  • MD5

    1a588c9f917ba36cf16e340747def2c7

  • SHA1

    2f9ea578b562e16dfbf4b70ecf58db88a909fc12

  • SHA256

    24b9c498e0b9de29894d6ed892864c6afde4d95143c9ceb4bca1b1d84b0e8b2e

  • SHA512

    8dee858b24377a80087aa35d34ed911fe2a7e36a0e60deb1433f6a622e0058797b6f9e4721a1ef5f7ec9855863b0f1cd8fe8cd41d04bd775f4b7688e9627edea

  • SSDEEP

    6144:jpZ/5O2fhG0b2nMJUxWdWJ4+en5BONtGd/e4nMgwQE3q9/U6x0tz3GsKU9X:jlDfIw2nuUxqeHKwU/ecfdxazWsNB

  Score

  10^/10

  cybergatebotdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2