Extracted

• • Target

    JaffaCakes118_80e21f9c733482d787e4824cbf1957e6

  • Size

    352KB

  • MD5

    80e21f9c733482d787e4824cbf1957e6

  • SHA1

    e8eb8a27369be6fff879be0b1edc19df6ae72acb

  • SHA256

    082398c9304264c1dfd664f4a41c181ad62a10ddc95e17139325e271d8444bf7

  • SHA512

    db455795fb7a1c749156f54ce88e2d415b2613e50693dcaf2e66fd3ca143b2c1d91620d52dbe482186247eac2f786a5eaaa60b4a3d4656fc2045cd4ad1c57c45

  • SSDEEP

    6144:dLlF4+Qr4UJsWXrFlMr69Uy3v9mEKQBVSohSoxvifp+98t+sstpO:VMpr4YFrF/Uy8onSZoBsrStpO

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2