Extracted

• • Target

    JaffaCakes118_628aebc54f433d9ae5b692b0d654db1d

  • Size

    687KB

  • MD5

    628aebc54f433d9ae5b692b0d654db1d

  • SHA1

    7a8262b2bcb3e29de38b97a901315833c393a739

  • SHA256

    996af8a68859552945851cbefda48dbd32b48a8656fffb67c48ee144de37a84c

  • SHA512

    299f3df62f1afc4eccf02343143ff841639a8c0c6994a027863810e26a6dcf2b04f55ab3b57ad1b5d4b7d97c5b166abed5b5ac6ab1e055a058436f201f1885a1

  • SSDEEP

    12288:5N4RQF0cZfhRp1kOmSRfpoWJZ7Pzgw8i8bd:5N4g0gJRLrRRFf7P98i8B

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2