Extracted

• • Target

    JaffaCakes118_21276e322e8ab028ca630a109f418c9f

  • Size

    387KB

  • MD5

    21276e322e8ab028ca630a109f418c9f

  • SHA1

    e06465e2ac869394930861e04366e42cd12feebc

  • SHA256

    7712f790931766ba9bde49f799daa313dde88caf7f3695437b8f0bcedb75bc09

  • SHA512

    f91f02e995e61b811dab26983975eb1b47a458bc2d2cc3578b3862ddb24841db341387d6bd3717e7e4b48dd0f03564882ef5462aa527328bab4a3eed250397ca

  • SSDEEP

    12288:uw2CsbAThtRfX9GwBl5ifC/zlvvgRIHby6igq:vsbEhtRT35iq/QUbynN

  Score

  10^/10

  cybergatetntalosaimidiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2