Extracted

• • Target

    JaffaCakes118_827842f6dd660817f4c56189d9a3169b

  • Size

    459KB

  • MD5

    827842f6dd660817f4c56189d9a3169b

  • SHA1

    640fedd073b74e27354db60c0eaee99c87b06c8c

  • SHA256

    cde2f8685f743e30d9e3b282cd9ec641cd3c6b762056ed730b10a0dd04ae1264

  • SHA512

    78fcefe129ba16481824db2defa8caf7c087d185c865b74b8ffb27e6dab67142c908f1abda04dc03e797adc097b91b8309c0b5bac32cbd4797b1e7a19c57a531

  • SSDEEP

    6144:SDgqEUppO61oyGnqzHsdhXH8cAyoJBenZgTfwWxAqI13mAF:G14ko1nV3XHAy3qTfwWxDA3b

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2