Extracted

• • Target

    JaffaCakes118_8548f4a8f8a1bba580145af21123b9fb

  • Size

    390KB

  • MD5

    8548f4a8f8a1bba580145af21123b9fb

  • SHA1

    9259359dadeb5968215adced8918209599c64af8

  • SHA256

    9dfe0205d87cb8ae5e9a1f3e7b180f250c68703a35a5e27f55fcb508b1ae5281

  • SHA512

    fe075cb9f6f364e05c8515177355e219e9b4ebc2bb55ed6a2e8245893b5a37de5fa2942d6f167e6cfc1f82bddc38a3a377be4d96ff60ff05e204e8e1c35effe7

  • SSDEEP

    6144:EKEJo0liJ8Rc3QTlG4uKYB/5KIvXFEQyvmoVOJdOHH0wF3DfHvmm:HQogO8G3QTlG4ublNEv7VuYn0A3DfHum

  Score

  10^/10

  cybergatethiagodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2