Extracted

• • Target

    JaffaCakes118_84420814705fdad80c366dd5713f5830

  • Size

    328KB

  • MD5

    84420814705fdad80c366dd5713f5830

  • SHA1

    f0628fb578daf51c2f5c799b68903c72166d8787

  • SHA256

    25da581d16da426be770d3be60f3e3c10ccc728bad8a88b082b50caeb16e8304

  • SHA512

    7873708d5438ebb9cfe14dc9f462e72ff50802b54d565bad5b1b000ad2fb0afc9dcbe2d35937625e2fbeaec7b42ef33c95ae755631a80b63875cc22b0c23a4a4

  • SSDEEP

    6144:QTYaePXgDV4rLVAaxxQAMzgC+KTxImcLpbLf1+opLFfOPiUDTi+Rx7ipx1KW:Na8gDV4rxAgrBC34ff1+ILMha+R1iaW

  Score

  10^/10

  cybergatecamfrogdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2