Extracted

• • Target

    JaffaCakes118_83d6cd97d67472203e3929c41fa08047

  • Size

    769KB

  • MD5

    83d6cd97d67472203e3929c41fa08047

  • SHA1

    94b913e12e701314fa642f8670531179c9d9ebeb

  • SHA256

    de0d44b22c9a7b31e10b05ce71a2437a5338152e83d5e4cf8d0456fd76b0b151

  • SHA512

    95d0ca8c5acade04b891263612312c373ff8bd8f0406d72d05fe38902933acfb3a5241811818b18c349acb32c073f5657cf51f0bb40ef9ff1db8859719efbc4e

  • SSDEEP

    12288:yqc5slzLDP7UKL0CvMhG5GEL3i2/cuhjQJIuS/s8TN07bzwiBNJJ+bQ8wKkixxcQ:tLDzBQEf4BybRPjsE

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2