Extracted

• • Target

    JaffaCakes118_67d5933a077555a210cacebede219755

  • Size

    360KB

  • MD5

    67d5933a077555a210cacebede219755

  • SHA1

    d4870b456798a386f46225e35d1b9a08dac9ce58

  • SHA256

    a8a485c79b99dde8c6c84b4c151f2ae77c3738ca6a5cf32c8f2fed71270a6cf9

  • SHA512

    435e41c15e0482623449fe458e42d4cbd78b2af43e71ba1d525f03067ab65191c56ea441b1f606a3aecdd809c66945270e3f5678399ff99a251666031aa48cf2

  • SSDEEP

    6144:6jVBZ1zt2YmQ2AymdQHX8z0d6/IYRu3dU21sWaVcw5Doeh6rLk9epa:AJeYmJVmoXt61Q3dNi3DBhU5pa

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2