Extracted

• • Target

    JaffaCakes118_6a7313805431616c78bfd371fedc9140

  • Size

    502KB

  • MD5

    6a7313805431616c78bfd371fedc9140

  • SHA1

    e3782733f006c71c04db60450c65201fd15edb50

  • SHA256

    69ef2c3bb0d87b9a39891fe5419ad365d23668b73dd3533dea5c19fbf2fc58ca

  • SHA512

    9ce53b3fe88b8027c77a7a69e8c4a52703825eb24329c284bdf9146ea44075f8f4100a6314f2709c0c366745fad2ef39968ba7746f5f8660f4b1fbb2122e241c

  • SSDEEP

    12288:uKxDAEyCzPmRdQcTyrL0OtoNg60TObnldgX72D/nJOxlPm9ZvroSB:uqcEyCaRXTyX0OmNg606bnldgXenJOxi

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2