Extracted

• • Target

    JaffaCakes118_aeb4f216e66a935eccee588400e03d60

  • Size

    408KB

  • MD5

    aeb4f216e66a935eccee588400e03d60

  • SHA1

    91daf65dd77b0da7a143c857d4f928bee566ba1c

  • SHA256

    01abdd4d93fb632eb8d454dcb26dd29c9990f061f9f62b12859d5719bb679e57

  • SHA512

    9d9dcf5314a3c1b84216194702f6818a174569d40619e32fdad18d888f19deddae39c284995aed45fa6a0b052fc9db386d4fbf1a28a15024c4a1d4fdff3a500c

  • SSDEEP

    6144:HJnaIyy/PWbFrgl74c5LJ3GD2c0yzdjn3e2LIGrYu+D2NrHAxy2J:1ao/P6oAD2/S3e2LIGrYum2Nrgx7

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1