Extracted

• • Target

    JaffaCakes118_aa14d6d68e5d16032ccd766e0aa1106c

  • Size

    365KB

  • MD5

    aa14d6d68e5d16032ccd766e0aa1106c

  • SHA1

    0f655aea9dc5d943e91ccf827270ce8b6964cb13

  • SHA256

    3883b65954ffa78a10d06c099568a199c524f33db6e973723efd3fe234a68498

  • SHA512

    db6e722d56a345204a1d7833f102cb6b130f46c7659b5b185607fe19dc42904bd907650a7c8667d772fbcdc5dad753fc93df0e1df05f7ee2025d5e58c0ca3dfc

  • SSDEEP

    6144:gw11mma5Io0kYnvPZAkQ2+27b7XGxbv+4d2eV2D9Qcxs1CeF+iWG6kaHSm:KPn0kgKVlvXd2U229EeFlWyUl

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1