Extracted

• • Target

    JaffaCakes118_802cf242ec2916cfdeab088170cd2197

  • Size

    315KB

  • MD5

    802cf242ec2916cfdeab088170cd2197

  • SHA1

    444294812c05729b5eb6fa6bd34c8b81d6dc957b

  • SHA256

    9df02b8511aae4d0c71d9f3b333f9bc831a11f96fa4982d351ea5b23cad7d146

  • SHA512

    c4f0ef531382ef7be4bed252b2f5e6342ecf436273bcf25deec2926fbd3d852ea6c2942af5045e989868617980d99aa481d19b413bf2ee3b29801e2cf938304c

  • SSDEEP

    6144:8F3+5zwRElkdnWW+tTmycM19uuD4SRqwIv1UZkxEh7aGfbAkP8E:/wRhWHmycM/8UeEh7pfbAC8

  Score

  10^/10

  cybergatecybergatediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2