Extracted

• • Target

    JaffaCakes118_8028aee0313e4fd77e66dce30e06e027

  • Size

    346KB

  • MD5

    8028aee0313e4fd77e66dce30e06e027

  • SHA1

    5724ff2c438c8e11900a3aacdf0a984d700f8160

  • SHA256

    26534d35383ed433fb71877c0176f7bd5d3ede20b92228595ea161c663ebae85

  • SHA512

    ac349d29cd8ee3e5409a490896ac3e98aed70603cb8cd71be53a4e47551be23c5af954a51255643008c9bdaee00d0f05e244629036690514045ce463c5d39827

  • SSDEEP

    6144:Oul2NZSHUtSsJIycAdk92GEd2YthEQW+r6QB/rNdMSgPjcmSUijg2I7qy:eSoSsJ5xGEEetrXRrd+cmSHg2I73

  Score

  10^/10

  cybergatels_forum_hackeddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2