Extracted

• • Target

    JaffaCakes118_2178329f21d5236643e74523702bb985

  • Size

    620KB

  • MD5

    2178329f21d5236643e74523702bb985

  • SHA1

    f0076205f5b84a7df4e84fe804c13aa3148c78da

  • SHA256

    c357e11fe451a55941b5cebc0e3cd413aad724478f4c0615be514936cd4a9639

  • SHA512

    cc2f1dba119ff0222cc6aef359294f7bc034d0375cde0484ef0e5adbe3e4a19bfa1f5f6ab20af0ac8c8ff07f4db422a027ef8aed5fbd126fdab252e63d5d9a73

  • SSDEEP

    6144:oR8/ipXZ5gH3/AStKfkIldz28072XNHzoQI8Omh5JGmrpQsK3RD2u270jupCJsCC:2UiJrI/tKRldz28V9zoQ7L8Z2zkPaCxM

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2