Extracted

• • Target

    JaffaCakes118_66a279981ad37c57de7b8c3f3161d46c

  • Size

    774KB

  • MD5

    66a279981ad37c57de7b8c3f3161d46c

  • SHA1

    413f7522dc6639405b492754748bd273a2440741

  • SHA256

    8d1f3f0e43d8bd4dadbcbd2593917f3b8990cf949e66f04928d700d953f96f10

  • SHA512

    7c162b5cf58d279acd90ba030f7cdbf3788bdc892251035ee1f3818d062107201d59ef2e55c5ecfd3bcdedcdd6a5e2017ad29416b71d4669291bfd39479f42a0

  • SSDEEP

    12288:Zn2IdaU228Z9P0g8zBTnRn8vOq5fXOdWWoqOn1uuhIQu7bed+4lM6cHhqBAC/9Ke:Z/dDTOzp1ueu7GZz6DO

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2