Extracted

• • Target

    JaffaCakes118_9c65089b9ee5779bf54e447774aae400

  • Size

    718KB

  • MD5

    9c65089b9ee5779bf54e447774aae400

  • SHA1

    7151c7c421aa881c2db84d19ca5b0fa2c5291344

  • SHA256

    1b4446fb599f41bb1851e99e0ba28f9ddf0d31c30fc3f0cc34f52df67bf9f174

  • SHA512

    cfc83fe8605fba5058ebfa8151a8e7217c024b8bd55172ef925b48d62da38d7bb1c4d7f03d25fb70dc27022eca050837f170518aee6a3d26198a4212989cffbb

  • SSDEEP

    12288:Z6wVuRiO7nH/HEIbNzuNhZ13j/mwdW5U4fwAn2MimOLI1rSbyySrO:QwwcqH/HDbNKZ13j/sFfkLI7BO

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1