Extracted

• • Target

    JaffaCakes118_31c01b92a1b969925ce36c57374df0e2

  • Size

    739KB

  • MD5

    31c01b92a1b969925ce36c57374df0e2

  • SHA1

    eafe68beabc6de3757985f47594b6fd898d340d2

  • SHA256

    74c2be2ad7638220e90fb7bc3b8fcb803250bc6cf09077e587a505c357f90f91

  • SHA512

    7d77e2c184820ca1e42a2720b499719dfe1800f3215bcdc71408999ac987f2acdc5c5e11a7141f50ca759ce4c40cfd1d85ae6e77b2337e31e7d466c77348fc27

  • SSDEEP

    12288:hfjZl2g5ZCNmdckHxQ5xf/gCUhtQMxKPZiGrN+qBDm6k3KqiHm:J2g5ImHQf4vtV8wGrNXwuqI

  Score

  10^/10

  discoverycybergateöííépersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2