Extracted

• • Target

    JaffaCakes118_5bc409f407b0f9b04f90f0657405d8fb

  • Size

    320KB

  • MD5

    5bc409f407b0f9b04f90f0657405d8fb

  • SHA1

    7b3ef9e89c645ff6a0b138d5ee3a541277e53c61

  • SHA256

    06c9beb47fd9874ce897c32fa6bf63641fbf00df8e79076766178164ae93e932

  • SHA512

    9d782e2ca6525ccd1ac32ed82cc6370116a318e4466ca393d28025c38ca37780a6d65f714050e6a2d0e2c6e17d55904818b2e491bd9e9a5dc3193323ca03f4ef

  • SSDEEP

    6144:htHC94BstoETpLBi4f7w6yDIFsUjAIVvIZvR1T43LSaZ0G:aEsfTjiVWjHVwxvTg2aZ

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2