Extracted

• • Target

    JaffaCakes118_b533f174f746bec6364305bee470c7f2

  • Size

    398KB

  • MD5

    b533f174f746bec6364305bee470c7f2

  • SHA1

    0a08eabceaf77aa4cd1dde40ae1955ff984343f5

  • SHA256

    29c18b16d1217714d4cbf67339bd1f06f3aba6cc224116b61fbf9ecd62915161

  • SHA512

    99035e2da20742cf19fcfe7fdc1a4444eb32552fcf6479249fd23cfd9988548939d20f2c45e17fa5973d74c8631bff22694490422bd5927d361d099be857e201

  • SSDEEP

    6144:gQWzX5l8pwRcczJLlJZm3iIG9mMqZGy/5cmLob45meqfEdfB0e0oobR5vP7:ZWDcpwNJpQiR9mh/5caHmVfq03PX7

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1