Extracted

• • Target

    JaffaCakes118_219501f9b017ac3044d9763ce84e1a11

  • Size

    524KB

  • MD5

    219501f9b017ac3044d9763ce84e1a11

  • SHA1

    dcd09daabb15b215dac35a564620f1f261d0272c

  • SHA256

    5e7202adbad15c09f1a94a4c9ceb9de78508d195f766e12f71c6bdd87aaff227

  • SHA512

    e0485c00ffc0238eda0fd6c453bb7fe04379264b004d29e53602d3f3a58d5728ee3eaf5206f2fed5264fe0edd0470dd86cdfdcad37f717e9f27b670bf0c479d3

  • SSDEEP

    6144:IoN3o8qcxsiYdBSpEYWhAFt0k93yOpxKQ++bjVLJnHNkwcUbtxjLjmYoPEveSUzC:7Y8ltF9wQ+4F9cUzXpUb9D/bYQ

  Score

  10^/10

  cybergate4chandiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2