Extracted

• • Target

    JaffaCakes118_873e4a3ed3ed0d58d107f53f97fbb326

  • Size

    766KB

  • MD5

    873e4a3ed3ed0d58d107f53f97fbb326

  • SHA1

    13108439dead8817c84e7d9749d6fa61c35c044b

  • SHA256

    f7d2d8558d6174e0141692d3ee5fe58c908b3815331b20445769d371a2686c46

  • SHA512

    10ab93db3e8e624b328c5c1703adf74cd2bc79e10144f3d21d63c5ff704e4810dada2469e084fe9d272ae7bbd7e5ea42e767dcdd3677e2ff446e60631e2a54a3

  • SSDEEP

    12288:mUvY+UAak+mSiAgI6hLu/CukdymK5Ur2IGc+1htqJxwp/Rk3Ss0Z6:mrjtcAgBhtu2ymKQ2DcEhQbW/Rkw6

  Score

  10^/10

  discoverycybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2