Extracted

• • Target

    JaffaCakes118_6c53dd033bb70047fd8c8cf5849c4a98

  • Size

    346KB

  • MD5

    6c53dd033bb70047fd8c8cf5849c4a98

  • SHA1

    a59758d4b46fa0be46ac9d1097b8a8502302df78

  • SHA256

    02252ee5ff2937580ff8d3ded0ce0182d3ca99ca3df0ff11477be61c655210a7

  • SHA512

    73912c64d1a900f4fa5441b5febebc36ff6fa838c493fe84c81389ade9db2da73d65b6be81a882faf47c6940eddeb3de498238da5773fec0526b906741c8f15a

  • SSDEEP

    6144:lmcD66RRjsZwzZw+5JGmrpQsK3RD2u270jupCJsCxCV:AcD663s06Z2zkPaCxk

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2