Extracted

• • Target

    JaffaCakes118_846051780709e6539020e3539b4865b8

  • Size

    406KB

  • MD5

    846051780709e6539020e3539b4865b8

  • SHA1

    5756d050e3b853b76b2ecd139631b24090bf9753

  • SHA256

    96eaedc8037a6df73c29934c37d5fc212a782035236ef1aa905c8893a7203b31

  • SHA512

    56536417892665854b1381dde5d1d73dd28bb40d0e0f59b439bf4db84cdec56d04553a4458c2f36168e8332e7172c531f207f7a7aa34b392c9425e0e9796a8fe

  • SSDEEP

    12288:kQswOG8iNk9a95LaxE5FxBYA9rrOqaQG660qCJEXASW9:nOGI895LaxEXL9/OqaQG03aASW9

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2