Extracted

• • Target

    JaffaCakes118_7d693d7b204391454a7286beeb81972e

  • Size

    360KB

  • MD5

    7d693d7b204391454a7286beeb81972e

  • SHA1

    e90bdcea7636594038637831f7e2513cb560d740

  • SHA256

    9e8b47d79c485f143dd1f6082530a3a4015a6dcec5ecc1ee7d164dc3b0e0412d

  • SHA512

    5ae416bf449c94ebf10242246e6c8b935839a3cb14be34060d300311f01ba640bf5f4a7ab1d7c42a3e9b553df7e4710ac7f104db34a4dd3b121ca18654bd1cba

  • SSDEEP

    6144:sgYT9hJn3x8D+537hq/MoZAJliY4fF/pvZ6qWIYn9scjbLg9HrdnRVa3/jKdz8LZ:srTjF3x8DxEoZ6kN/T+DoH9RVamdId

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2