Extracted

• • Target

    JaffaCakes118_7c8d56327cf6f5e5c58e1f7fdfc0e6ad

  • Size

    428KB

  • MD5

    7c8d56327cf6f5e5c58e1f7fdfc0e6ad

  • SHA1

    07fd74ac60ea30dfb9cfe0b6ae957811832f6715

  • SHA256

    248c5ec74aa13590f61e9368b7d7db8b514bdbb8bcb07ff69778e734b515278c

  • SHA512

    532bfbcbe6c798fb5f5a2f30becf26b52ed4a7d2f3f4787c86e0977bb5a290bed1b07dc41d6977b0ebedf94d8baa9225af7e946bc834f317449e2f1dc36154f0

  • SSDEEP

    12288:ECchz7QWAybsWbD0fvFoOJdWdDu7/GoVobKHR:tchz73ZbsW6JJd4Du7OoVobKx

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2