Extracted

• • Target

    JaffaCakes118_9d0aaf778447467d2727abc2b59bd537

  • Size

    401KB

  • MD5

    9d0aaf778447467d2727abc2b59bd537

  • SHA1

    b1606f9d0730033fa3ea703af7ca7d46d6171916

  • SHA256

    2f42d93339350d8b3b3dcdb1a37602c8549e5c329e75c7ce2a6ac036ae3c4e86

  • SHA512

    9aea74e4ed86e6e27a4c88a3021bd6d22d3a07abaf3701b252b5070787aafdfa53ad3f068b8bebb1ddf6349ecb76e32c94906637213d6835d3e9ed5aa8a487da

  • SSDEEP

    12288:2aC8zt5KF9UC4N1pBVrODeuZccbLHvZlBicGan:ggLciN17VrOKuTXv/wcGa

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1