Extracted

• • Target

    JaffaCakes118_601a74ebe470cc151f77f414eec5e6d4

  • Size

    569KB

  • MD5

    601a74ebe470cc151f77f414eec5e6d4

  • SHA1

    54f5e0d493b817e8457cdc746de0b1c67cb12d4a

  • SHA256

    7aae8f8c3258b65329af918458c88a2de723f8686ea20e9d3656b199aa01d39a

  • SHA512

    9efbac47419639adb7f9d5014a32ec1fa2bf234a149dcc304b63b7c501379a2f0e23bb4a47cae577a412215856827b6d19bf91f058183a0e7f87434af212db4c

  • SSDEEP

    12288:HAVs/0TLrD9bP/Dqfg/28nr31PYC8fgqNeAtpVxagMU/plruchDofAPe:wj9bP/Dqfg/hn1lOFpNvfucVof+e

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2