Extracted

• • Target

    JaffaCakes118_863e87a6fcb5e870cc0a797bb3b75b91

  • Size

    316KB

  • MD5

    863e87a6fcb5e870cc0a797bb3b75b91

  • SHA1

    68c06fe248295afd6080b480f1a1a903fa76e2a9

  • SHA256

    913398ba1d6b5e35b3b289a38770722f6cd731127dfdad12fd6cde88a92e1aee

  • SHA512

    9706d61d633e9d11de682ef36ead6b72337ada373b1921e5a67733a452509e767dc1d453b76aa200e704fe9663b14abafdd7bdcb0a31ff5a8cd668dd98e81dc7

  • SSDEEP

    6144:A/PQ1dSTTq9gHQUD1hle+LSV/tykl0c32DpKrHmSvBdBAbe3:E4eTGUxhl5E5l0Y29cHmCB6+

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2