Extracted

• • Target

    JaffaCakes118_7822ff50a80eebbaec56bd05b10d6697

  • Size

    428KB

  • MD5

    7822ff50a80eebbaec56bd05b10d6697

  • SHA1

    2f303b8c88fa89a0007ddf00e269101469c4f446

  • SHA256

    1a8db3eae1aad37c730697e6c49a26dfff984589f6128a911c9913461aa51894

  • SHA512

    f0e7060a8f0f0b80a666cf24eea19dae0639437beeb4a8b2fae99b2a2965f3f2ea124ada80c6ef20876c2b68cea2067dd0baadded488e036bff1f0c4d121be5b

  • SSDEEP

    12288:MJHJY2bpXpqBGLDjY9q5IZUeDgeQXFaYhKv/Msl3wF:OHS2pKxq5IWeDo4qCMs

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2